A build account runs a CodePipeline that builds a Lambda artifact in CodeBuild and stores encrypted artifacts in an S3 bucket using the aws/s3 AWS‑managed KMS key. The pipeline’s CloudFormation deploy actions run in separate development and production accounts and fail with access denied when those actions try to access artifacts. Which steps resolve the error? (Choose two.)

The correct options address cross-account access to encrypted S3 artifacts. Creating a customer-managed KMS key (CMK) and configuring its key policy to allow decryption by the IAM roles in the development and production accounts is a valid solution. AWS-managed keys (aws/s3) cannot have their key policies modified to grant cross-account access for decryption. By using a CMK, you gain control over the key policy, enabling the necessary permissions. The other correct option involves creating IAM roles in the target accounts with permissions to decrypt and retrieve objects from the pipeline artifacts bucket. Then, the pipeline's S3 bucket policy must be updated to grant these roles access. Finally, the CloudFormation actions in the pipeline are configured to assume these newly created roles, allowing them to access the artifacts securely. Incorrect options: Creating S3 buckets in each target account and copying artifacts adds complexity and unnecessary data duplication. Creating an AWS-managed KMS key and modifying its policy is not possible; AWS-managed keys have fixed policies. Creating IAM roles without updating the S3 bucket policy or using a CMK for decryption would still result in access denied errors for the encrypted artifacts.