AWS DevOps Engineer Professional Practice Test

When using a custom Docker image for a CodeBuild task, which option should be selected if the image is stored in a separate AWS account?

1. Another Region

2. Amazon ECR and Another Account

3. Amazon ECR and Local Repository

4. Default Account

The correct answer is: Amazon ECR and Another Account

When utilizing a custom Docker image for a CodeBuild task that is stored in a separate AWS account, selecting the option that specifies "Amazon ECR and Another Account" is the correct choice. This option allows the CodeBuild project to access the Elastic Container Registry (ECR) repository that exists in a different AWS account. For CodeBuild to pull the Docker image from another account, proper permissions must be set in the permissions policy of the ECR repository to allow access to the IAM role that CodeBuild uses. By designating the image as being in "Another Account," you acknowledge the need for cross-account access management, ensuring that the necessary permissions are clearly established for successful image retrieval. Other options do not adequately address the scenario of accessing a Docker image from a different AWS account. Using "Another Region" would suggest geographic separation rather than account separation, which doesn't facilitate cross-account ECR access. The option referencing "Local Repository" would imply that the image is either stored locally within the CodeBuild environment or within the same AWS account, which does not apply in this case. Lastly, choosing "Default Account" would indicate reliance on the standard ECR configuration within the same account, contradicting the requirement to access a separate account.