Examkin

Question

Difficulty: MediumAWS CodeBuild

A developer is configuring a buildspec.yml file for an AWS CodeBuild project. The build environment requires access to a database connection password stored in AWS Secrets Manager and a non-sensitive configuration parameter stored in Systems Manager Parameter Store. The developer wants to retrieve these values securely and inject them as environment variables during the build phases without hardcoding them in the source code. Which approach should the developer take to retrieve these values?

  1. Define the non-sensitive configuration under the parameter-store mapping and the database password under the secrets-manager mapping inside the env section of the buildspec.yml file.Answer
  2. B
    Define both the non-sensitive configuration and the database password under the parameter-store mapping inside the env section of the buildspec.yml file, referencing the Secrets Manager secret ARN as the parameter value.
  3. C
    Define both variables under the variables mapping inside the env section of the buildspec.yml file, prefixing the database password value with secrets: and the configuration value with ssm: to trigger resolution.
  4. D
    Define both variables under the variables mapping inside the env section of the buildspec.yml file, and modify the trust policy of the CodeBuild service role to allow Systems Manager and Secrets Manager to write values directly to the build container.

Answer

Define the non-sensitive configuration under the parameter-store mapping and the database password under the secrets-manager mapping inside the env section of the buildspec.yml file.
The correct option correctly uses CodeBuild's native capabilities to resolve environment variables. Defining the parameter in the parameter-store block and the secret in the secrets-manager block under the env section of buildspec.yml ensures that CodeBuild calls the appropriate AWS APIs at build initialization, retrieves the values securely, and makes them available to the build environment phases.

Step-by-Step Solution

1
Identify where the database connection password and non-sensitive configuration parameters are stored.
The password is in AWS Secrets Manager, and the parameter is in Systems Manager Parameter Store.
Understanding the source storage determines the corresponding configuration block to use in the buildspec.
2
Map the storage locations to the native environment variable structures supported by AWS CodeBuild.
AWS CodeBuild provides parameter-store and secrets-manager blocks under the env section of buildspec.yml to natively retrieve these values.
Using native blocks allows CodeBuild to automatically fetch the values at runtime using the build's IAM role, ensuring they are not hardcoded or exposed.
3
Specify the parameters under their correct respective blocks in the env section.
The configuration parameter goes under parameter-store and the database password goes under secrets-manager.
This guarantees that both services are accessed using the correct APIs and the fetched values are injected as environment variables.

Key Concept

AWS CodeBuild Environment Variable Resolution
Rate this question

Topics

AWS CodeBuild

More questions from this topic