DOP-C02 Question 123

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A2

  A. Configure the application account’s deployment IAM role to have a trust relationship with the centralized DevOps account. - setup trust relationship on the account that has resources, which is the application account Configure the trust relationship to allow the sts:AssumeRole action. - allow CodeBuild from centralized account assume it - CodeBuild is configured in Centralized DevOps account but not in application account. Configure the application account’s deployment IAM role to have the required access to the EKS cluster. Configure the EKS cluster aws-auth ConfigMap to map the role to the appropriate system permissions. - the application account has access to the resources

• Chose A6

  A is correct: <Unauthorized error during attempts to connect> means we need to setup relevant permissions and policies - A is correct because < AWS CodeBuild project that is set up in the centralized DevOps account>, so we should setup trust relationship on the account that has resources, which is the application account and allow codebuild from centralized account assume it B and C are wrong: we need to setup trust from the app account, not the centralized account. D: this option mentions control Tower, which is irrelevant

• Chose A10

  A. Configure the application account’s deployment IAM role to have a trust relationship with the centralized DevOps account. Configure the trust relationship to allow the sts:AssumeRole action. Configure the application account’s deployment IAM role to have the required access to the EKS cluster. Configure the EKS cluster aws-auth ConfigMap to map the role to the appropriate system permissions. Options B, C, and D are not correct because the centralized DevOps account’s deployment IAM role doesn't need to trust the application account, it's the other way around. The sts:AssumeRoleWithSAML action in option C is used for federation from a SAML 2.0 compliant identity provider and is not necessary in this scenario. Lastly, there's no need to have a trust relationship with the AWS Control Tower management account as in option D, as the interaction is directly between the DevOps account and the application account.