Examkin

Question

Difficulty: HardAWS CodeBuild

A developer is configuring a continuous integration pipeline using AWS CodeBuild to compile a Node.js application, run unit tests, and push the resulting container image to an Amazon Elastic Container Registry (ECR) repository. The developer needs to configure the build process to meet the following requirements:

* The unit tests must run during the build process. If they fail, the build must stop immediately and mark the build run as failed.
* A cleanup script must execute to remove temporary files, regardless of whether the unit tests succeed or fail.
* The Docker image must only be built and pushed to Amazon ECR if all unit tests pass.

Which configuration should the developer use to meet these requirements?

  1. Configure the buildspec file to run the unit tests in the build phase. Place the cleanup script in the post_build phase to run unconditionally. In the post_build phase, check the value of the CODEBUILD_BUILD_SUCCEEDING environment variable, and only build and push the Docker image if its value is 1.Answer
  2. B
    Configure the buildspec file to run the unit tests in the pre_build phase. Use the on-failure: CONTINUE attribute for the test command so the build proceeds. In the build phase, build and push the Docker image, and run the cleanup script in a custom phase named cleanup at the end of the build.
  3. C
    Configure the buildspec file to run unit tests in the build phase and the cleanup script in the post_build phase. To authenticate with Amazon ECR, store the ECR authorization token in Systems Manager Parameter Store with automatic rotation enabled, and reference it under the env: parameter-store block of the buildspec file.
  4. D
    Configure the buildspec file to run the unit tests in the build phase, and place the ECR push commands in the post_build phase. To allow CodeBuild to authenticate, update the trust policy of the CodeBuild service role to allow the ecr.amazonaws.com service principal to assume the role, and attach a policy allowing ecr:GetAuthorizationToken to the role.

Answer

Configure the buildspec file to run the unit tests in the build phase, place the cleanup script in the post_build phase to run unconditionally, and check the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase before building and pushing the Docker image.
The correct configuration uses the build phase to run the tests and the post_build phase to run the cleanup script unconditionally. By checking the value of the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase, the developer can conditionally build and push the Docker image only if all previous phases succeeded.

Step-by-Step Solution

1
Determine the appropriate lifecycle phases for execution and cleanup.
Unit tests are placed in the build phase so they fail the build immediately if they return a non-zero exit code. The cleanup script is placed in the post_build phase because it is guaranteed to execute even if the build phase fails.
CodeBuild executes the post_build phase regardless of the success or failure of previous phases, making it the correct place for cleanup tasks.
2
Implement conditional execution for the Docker build and push.
Check the value of the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase. If it is 1, proceed with the Docker build and ECR push commands; otherwise, skip them.
Using the built-in CODEBUILD_BUILD_SUCCEEDING variable prevents pushing an invalid or untested image if the unit tests in the build phase failed.
3
Ensure security and permission compliance.
Verify that the CodeBuild service role has a trust policy allowing codebuild.amazonaws.com to assume the role and permissions to write to ECR.
This guarantees that the CodeBuild service can assume the role and successfully push the Docker image to the registry.

Key Concept

AWS CodeBuild buildspec phases, environment variables, and execution behavior.
Rate this question

Topics

AWS CodeBuild

More questions from this topic