Exam AWS DevOps Engineer Professional topic 1 question 174 discussion

C is more suitable.

A. If Codepipeline iam service role's does not have the required iam services to use parameter store it would fail in all stages of the codepipeline services. B. it's not right because the decripter is SSMM C. it looks more plausible, because codebuild service needs permissions to access to parameter store.

c-c-c-c-c-c-c-c-c

Answer is C. It has to be permission of the IAM Service Role of CodeBuild. It cannot be AWS/SSM Key because System Manager is supposed to decrypt secured string on behalf of the caller of System Manager to retrieve the value from the Parameter Store.

CodePipeline uses CodeBuild to run the build stage, so the CodeBuild IAM service role is responsible for interacting with the services and resources specified in the build stage. If the role does not have the required IAM permissions to use Parameter Store, the pipeline will fail during the build stage when the CodeBuild service attempts to access the parameter values specified in the environment variables. It's a good practice to check the IAM permissions for the roles that CodePipeline, CodeBuild and CodeDeploy uses and make sure they have the correct permissions to access the services and resources that are being used in the pipeline.

i vote C