DVA-C02 Troubleshooting and Optimization Practice Question
A company uses AWS CodePipeline with CodeBuild to test and deploy a web application. The pipeline has been failing at the deploy stage with an error: 'Access Denied'. CloudTrail shows the CodePipeline service role is making the call. What is the MOST likely cause?
⚠ Common exam trap
Candidates often confuse the CodeBuild service role with the CodePipeline service role, assuming the build role is responsible for deployment, when in fact CodePipeline uses its own role for the deploy action.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CodePipeline service role lacks permissions for the deploy action.
The error 'Access Denied' in the deploy stage, with CloudTrail showing the CodePipeline service role making the call, indicates that the IAM role assumed by CodePipeline does not have the necessary permissions to perform the deploy action against the target provider (e.g., ECS, S3, Elastic Beanstalk). CodePipeline uses its service role to invoke the deploy action, and if that role lacks the required `codedeploy:*`, `s3:PutObject`, or `ecs:UpdateService` permissions, the API call will be denied.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The CodeBuild project does not have internet access.
Why it's wrong here
If the CodeBuild project lacked internet access, it would typically fail during the build stage when attempting to download external dependencies like npm packages or Maven artifacts. This failure would prevent the build artifact from being created and passed to subsequent stages. Consequently, the pipeline would halt in the build stage, never reaching the deploy stage to encounter an 'Access Denied' error there.
- ✓
The CodePipeline service role lacks permissions for the deploy action.
Why this is correct
An 'Access Denied' error during the deploy stage is a classic indication that the AWS CodePipeline service role lacks the necessary IAM permissions to perform the deployment actions on the target AWS resource. For instance, if deploying to an S3 bucket, the role needs `s3:PutObject` and `s3:GetObject` permissions for the artifact. Without these explicit `Allow` statements in its policy, the service principal is unauthorized to interact with the target service, resulting in the reported access denial.
- ✗
The deploy provider (e.g., ECS, S3) is not in the same AWS region.
Why it's wrong here
AWS CodePipeline is designed to support cross-region deployments, allowing artifacts processed in one region to be deployed to resources in another. The mere fact that the deploy provider is in a different AWS region does not inherently cause an 'Access Denied' error. While cross-region operations might require specific S3 bucket policies for artifact transfer, the fundamental issue of an access denial points directly to insufficient IAM permissions for the CodePipeline service role. It is not a consequence of a regional mismatch itself.
- ✗
The source code repository does not have the correct branch.
Why it's wrong here
If the source code repository did not have the correct branch configured for the pipeline, the failure would occur much earlier in the Source stage. CodePipeline would be unable to retrieve the input artifact, leading to a 'Failed' status in that initial stage. The pipeline would never progress to the Deploy stage to encounter an 'Access Denied' error, as no artifact would have been successfully pulled or built.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.