DOP-C02 SDLC Automation Practice Question
A DevOps engineer is setting up an AWS CodePipeline to deploy a web application to an EC2 instance using AWS CodeDeploy. The deployment group uses an in-place deployment configuration. The pipeline's deploy stage fails with the error: 'The overall deployment failed because too many individual instances failed deployment, too few healthy instances are available, or some instances in your deployment group are experiencing problems.' The engineer checks the CodeDeploy logs on the instance and finds that the 'BeforeInstall' lifecycle hook script is failing. The script attempts to download a package from an Amazon S3 bucket that is encrypted with SSE-KMS. What is the MOST likely cause of the failure?
⚠ Common exam trap
Test-takers frequently assume the CodeDeploy agent handles all S3 access, but the script runs under the instance's IAM role, and missing KMS permissions are a common oversight when using encrypted artifacts.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role attached to the EC2 instance lacks the 'kms:Decrypt' permission for the AWS KMS key used to encrypt the S3 object.
The error occurs because the EC2 instance's IAM role lacks the `kms:Decrypt` permission for the AWS KMS key used to encrypt the S3 object. When the `BeforeInstall` script attempts to download the package, the AWS SDK or CLI on the instance must decrypt the object using the KMS key. Without this permission, the download fails, causing the lifecycle hook to fail and the overall deployment to abort due to too many failed instances.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The EC2 instance does not have internet access to reach the S3 bucket.
Why it's wrong here
If the instance is in a private subnet without a NAT gateway or VPC S3 endpoint, the aws s3 cp command in the BeforeInstall script would fail with a network connectivity error (e.g., timeout or 'Unable to connect to the endpoint'), not a KMS-related access failure. A network issue prevents the HTTP request from reaching S3 at all, so it would not produce the permission-denied symptom described in the deployment failure. Thus, while a lack of internet access could cause script failure, it is not the specific cause implied by the encrypted S3 object scenario.
- ✗
The S3 bucket name is misspelled in the 'BeforeInstall' script.
Why it's wrong here
A misspelled S3 bucket name in the BeforeInstall script would cause the S3 API to return a NoSuchBucket (404) error because the bucket does not exist or is not accessible under that name. This is fundamentally different from a KMS permission failure: the object location is incorrect, not the encryption authorization. The deployment log would show an InvalidBucketName or NoSuchBucket exception, not a kms:Decrypt denial, so this option does not match the described error context.
- ✓
The IAM role attached to the EC2 instance lacks the 'kms:Decrypt' permission for the AWS KMS key used to encrypt the S3 object.
Why this is correct
In CodeDeploy, lifecycle hook scripts (such as BeforeInstall) run on the target instance and use the instance's IAM role, not the CodeDeploy service role. If the S3 object is encrypted with an AWS KMS customer-managed key, the script's `aws s3 cp` or `aws s3api get-object` call requires both s3:GetObject on the bucket/object and kms:Decrypt permission for that key. Even if s3:GetObject is allowed, lacking kms:Decrypt causes the S3 client to fail with an AccessDeniedException when it attempts to retrieve the plaintext, making the lifecycle hook exit non-zero and the deployment fail. This is the exact scenario that produces a script failure pointing to encryption authorization.
- ✗
The CodeDeploy agent does not have permissions to read from the S3 bucket.
Why it's wrong here
The CodeDeploy agent downloads the deployment revision from S3 before executing any lifecycle event hooks, using the instance's IAM role. If that role lacked s3:GetObject, the agent would fail immediately during artifact retrieval, and the deployment would never reach the BeforeInstall stage. Once the agent successfully fetches the bundle and executes the script, any subsequent S3 access from the script is again governed by the instance role; the agent itself is not making a separate S3 read at that point. Therefore, an agent-level permission issue would manifest as an early download failure, not a KMS-related script error during the hook.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.