DOP-C02 Cross-account IAM role Practice Question
Which TWO steps are required to set up a cross-account CI/CD pipeline where the source stage is in Account A (CodeCommit) and the deploy stage is in Account B (ECS)? (Choose 2.)
⚠ Common exam trap
The trap is that the question originally expected three steps, but for this setup only the cross-account IAM role and the CodePipeline service role trust update are required. Candidates may incorrectly add a target-account KMS key or S3 bucket.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action.
For a cross-account CI/CD pipeline where the source stage (CodeCommit) is in Account A and the deploy stage (ECS) is in Account B, only two steps are required: 1) Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action (Option A). 2) Update the CodePipeline service role in Account A to include a trust policy that allows assuming the role in Account B (Option C). You do not need a KMS key in Account B; if the artifact bucket in Account A is encrypted with a customer-managed AWS KMS key, the key is in Account A and its policy must grant Account B's role kms:Decrypt, but that is not one of the required setup steps in the options. Option D is incorrect because the CodeCommit repository is in Account A, not Account B. Option E is incorrect because the pipeline artifact bucket should reside in Account A, not Account B.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role in Account B that the pipeline in Account A can assume for the deploy action.
Why this is correct
Correct: The IAM role in Account B is what CodePipeline assumes for the deploy action in ECS.
- ✗
Configure an AWS KMS key in Account B and share it with Account A for encrypting artifacts.
Why it's wrong here
Incorrect: A KMS key in Account B is not required. If a customer-managed KMS key is used for the artifact bucket, it is in Account A, and the Account B role needs decrypt permission on that key, not a shared Account B key.
- ✓
Update the CodePipeline service role in Account A to include a trust policy that allows assuming the role in Account B.
Why this is correct
Correct: The CodePipeline service role in Account A must allow sts:AssumeRole to the Account B deploy role.
- ✗
Create a resource-based policy on the CodeCommit repository in Account B that grants access to the CodePipeline service role in Account A.
Why it's wrong here
Incorrect: The CodeCommit repository is in Account A, so there is no CodeCommit repository in Account B and no resource-based policy is needed there.
- ✗
Create an S3 bucket in Account B to store the artifacts and grant cross-account access.
Why it's wrong here
Incorrect: The S3 artifact bucket should reside in Account A, the pipeline account, not Account B.
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.