DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

Service-managed StackSets are the correct low-overhead deployment model when AWS Organizations trusted access is enabled. CloudFormation creates and manages the required StackSet execution roles, so self-managed permissions are unnecessary. However, AWS explicitly states that service-managed StackSets do not deploy stacks to the organization management account, even if the management account is part of the organization or belongs to an OU. Therefore, targeting the root OU deploys to the member accounts, but the management account still needs a separate normal CloudFormation stack. Option B is the only answer that covers both the member accounts and the management account with the least operational overhead. Option A misses the management account, while C and D require unnecessary self-managed role administration.

================

The problem has two distinct requirements: securely managing rotating external API credentials and encrypting CodeBuild artifacts with a specific KMS key.

For credentials that must be reset each month and are sensitive, AWS Secrets Manager is the appropriate service, not Parameter Store. Secrets Manager provides built-in support for secret rotation, versioning, access control, and auditability. The external API credentials can be updated monthly either manually or via an automated rotation Lambda. CodeBuild can read the secret at build time by assuming an IAM role that allows secretsmanager:GetSecretValue .

To encrypt CodeBuild outputs, the correct pattern is to set the CODEBUILD_KMS_KEY_ID environment variable (or CodeBuild project setting) to the desired KMS key. The CodeBuild IAM service role must be granted kms:Encrypt , kms:Decrypt , and related actions on that KMS key via the key policy or IAM policy. This ensures build artifacts and logs are encrypted using the specified customer managed key.

Option C captures both requirements precisely: store credentials in Secrets Manager and update the KMS key policy for the CodeBuild role , not the CodePipeline role. Options A and B misuse Parameter Store and/or the wrong IAM principal. Option D updates the wrong role and does not connect the KMS key to CodeBuild’s artifact encryption.

CodeDeploy supports TimeBasedLinear traffic shifting for ECS blue/green deployments. Traffic increments by linearPercentage every linearInterval until 100%. This provides zero-downtime gradual rollout — as per CodeDeploy ECS Blue/Green Traffic Shifting documentation.