Q: 2
A company uses an AWS CodeArtifact repository to store Python packages that the company
developed internally. A DevOps engineer needs to use AWS CodeDeploy to deploy an application to
an Amazon EC2 instance. The application uses a Python package that is stored in the CodeArtifact
repository. A BeforeInstall lifecycle event hook will install the package.
The DevOps engineer needs to grant the EC2 instance access to the CodeArtifact repository.
Which solution will meet this requirement?
Options
Discussion
Option D again with more AWS hoops to jump through just for package access, but that's their typical stance.
Maybe B, since a resource-based policy can allow access from specific principals, and EC2 does have an identity. I think it feels more straightforward to just grant read permissions this way, but not 100% sure if CodeArtifact supports that for EC2 directly. D is definitely the official IAM play, though.
D . Using an instance profile with the right IAM permissions is the typical way for EC2 to hit CodeArtifact, plus aws codeartifact login. Not seeing how B would work for a direct EC2 principal. Anyone disagree?
D , since EC2 principal needs an instance profile unless the repo is accessed by something outside the account.
D. Resource-based policy (B) is a bit of a trap here-CodeArtifact doesn’t let you grant direct EC2 access that way. Instance profile plus aws codeartifact login is what AWS expects for this scenario, pretty sure. Disagree?
Looks like D is right, but I could see people picking B since resource-based policies sometimes come up on these kinds of questions. Not fully sure though, AWS wording gets tricky with CodeArtifact.
D here. Instance profile with the right IAM role is standard for EC2 to pull from CodeArtifact, then just use aws codeartifact login. Haven't seen ACLs used with CodeArtifact, so C doesn't work. Pretty sure this lines up, but let me know if I missed something.
On the EC2 principal question, does AWS even let you target an instance directly in a CodeArtifact resource policy, or would that only work for things like Lambda? Just want to double-check the use of B.
C/D? Not 100%, question leans D but B seems possible for some setups.
D , saw this covered in the official AWS guide and on practice tests too.
Be respectful. No spam.
