Build and test run in a shared tools account, but production lives in separate accounts. How should CI/CD deploy safely across those accounts?
Select an answer to reveal the explanation.
Short Explanation
The tools account builds; production stays locked unless the pipeline puts on a temporary badge. Cross-account roles let CodePipeline deploy without parking root keys in the workshop.
Full Explanation
Cross-account CI/CD with CodePipeline and IAM roles (assume-role into production) is the standard pattern for safe multi-account deploys. Sharing root credentials, embedding access keys in build env vars, or relying on personal laptop deploys violate least privilege and auditability.