DOP-C02 SDLC Automation Practice Question
A company has a CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The build stage runs unit tests and produces a JUnit report. The pipeline includes a test action that publishes results to an S3 bucket. Recently, the pipeline started failing with the error: 'The action could not be started because the artifact bucket policy is misconfigured.' What is the most likely cause?
⚠ Common exam trap
Candidates often assume the error is due to KMS key rotation or cross-region issues, but the specific wording 'artifact bucket policy is misconfigured' directly points to an IAM/bucket policy permission problem, not encryption or replication settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The artifact bucket's bucket policy does not grant the necessary permissions to the CodePipeline service role.
AWS CodePipeline requires the artifact bucket's bucket policy to grant the CodePipeline service role (or the pipeline's assumed role) permissions to perform actions like s3:GetObject, s3:PutObject, and s3:GetBucketVersioning. When the bucket policy is misconfigured—for example, missing a principal or action—the pipeline's test action cannot start, resulting in the specific error message. This is a common IAM/permissions issue rather than a regional or encryption key problem.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The S3 bucket has Amazon S3 Transfer Acceleration enabled, which is not supported by CodePipeline.
Why it's wrong here
S3 Transfer Acceleration is fully supported for CodePipeline artifact buckets; it simply uses CloudFront edge endpoints to speed up transfers. Enabling it does not alter the bucket's access control or permission model, so it cannot cause the access-denied error described. The error is a permissions problem, not a transport-layer feature conflict.
- ✗
The KMS key used to encrypt the bucket objects has been rotated, causing the pipeline to lose access.
Why it's wrong here
AWS KMS automatic key rotation only creates new backing keys while retaining the same key ID, so key usage policies and grants remain valid. If the key were manually rotated by disabling or replacing it, the pipeline would encounter an AccessDenied from KMS when calling kms:Decrypt, not a bucket-policy-related error. The specific error text points to the bucket policy, so this explanation does not match the symptom.
- ✗
The artifact bucket is in a different AWS Region than the pipeline, and cross-region replication is not enabled.
Why it's wrong here
CodePipeline handles cross-region pipelines by provisioning separate artifact buckets in each AWS Region and configuring actions with the appropriate bucket ARN; it does not rely on S3 Cross-Region Replication to copy artifacts. A different-region bucket is a supported configuration as long as the pipeline and the bucket are correctly specified in the action's ArtifactStore. The failure described involves the bucket policy in the region where the bucket exists, not replication, so this is incorrect.
- ✓
The artifact bucket's bucket policy does not grant the necessary permissions to the CodePipeline service role.
Why this is correct
The CodePipeline service role must be explicitly listed as a principal in the artifact bucket's bucket policy with permissions like s3:GetObject, s3:PutObject, and s3:ListBucket. If the bucket policy is missing or uses the wrong role ARN, the pipeline gets an AccessDenied error when trying to read or write artifacts. This is the correct root cause because CodePipeline validates bucket access via the bucket policy and the attached IAM role policies.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,013 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.