Examkin

Question

Difficulty: Very hardAWS CodePipeline

A developer is configuring a CI/CD pipeline in AWS CodePipeline. The pipeline consists of a Source stage, a Build stage running AWS CodeBuild, and a Deploy stage running AWS CloudFormation. During the Build stage, CodeBuild executes a script that generates a dynamic configuration token required by the CloudFormation template as a parameter named ConfigToken. The pipeline must support concurrent executions without resource state conflicts, out-of-band credential dependencies, or exposure of sensitive data. Which configuration should the developer implement to pass this dynamic token to the CloudFormation deployment action?

  1. A
    Write the dynamic token to AWS Secrets Manager using an AWS SDK call during the build phase. In the CloudFormation Deploy action, reference the token in the template parameters using the dynamic reference pattern {{resolve:secretsmanager:ConfigToken}}.
  2. B
    Generate a variables.json file containing the token in a subdirectory of the repository during the build. Configure CodePipeline to pass this subdirectory as a secondary input artifact to the Deploy stage, and reference it in the CloudFormation ParameterOverrides using the syntax SecondaryArtifact::variables.json::ConfigToken.
  3. Define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml and assign the value during the build phase. Set a Namespace (e.g., BuildVariables) in the CodePipeline build action, and configure the CloudFormation Deploy action ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.Answer
  4. D
    Configure the CodeBuild service role with a trust policy that allows it to assume the CodePipeline service role. During the build phase, execute a script that calls the AWS CLI update-pipeline command to modify the default parameter values of the pipeline's CloudFormation Deploy stage.

Answer

Define the ConfigToken under exported-variables in the env section of the buildspec.yml, set a Namespace on the CodePipeline build action, and reference it in the CloudFormation ParameterOverrides using the format {"ConfigToken": "#{BuildVariables.ConfigToken}"}.
The correct option is to define ConfigToken under exported-variables in the env section of the CodeBuild buildspec.yml, assign a Namespace to the Build action, and configure the CloudFormation ParameterOverrides using the syntax #{Namespace.Variable}. CodePipeline natively supports variable sharing across actions using execution namespaces. Each execution has its own runtime scope, which ensures that concurrent pipeline runs remain isolated and do not overwrite each other's data.

Step-by-Step Solution

1
Export the variable in CodeBuild
ConfigToken is defined under the exported-variables key in the buildspec's env section.
This registers the variable with AWS CodeBuild, making it eligible to be captured by AWS CodePipeline upon build completion.
2
Assign a namespace to the Build action
The Build stage action configuration is updated with a Namespace property (e.g., BuildVariables).
Creating a namespace allows other actions within the same pipeline execution path to access the output variables of this specific action.
3
Reference the namespace variable in the CloudFormation action
The ParameterOverrides parameter is set to reference the variable using #{BuildVariables.ConfigToken}.
CodePipeline dynamically interpolates variables using the #{Namespace.VariableName} format during execution, ensuring isolation and supporting concurrency.

Key Concept

AWS CodePipeline variables and namespaces
Rate this question

Topics

AWS CodePipeline

More questions from this topic