Examkin

Question

Difficulty: HardAWS CodeBuild

An organization requires a build environment in AWS CodeBuild to execute integration tests against an internal Amazon RDS DB instance situated in a private subnet. The build container must fetch external software packages from the public internet and retrieve a database password from AWS Secrets Manager. Currently, the build execution fails because it cannot access external repositories, and an authorization error occurs when fetching the credential from AWS Secrets Manager.

Which combination of steps should be taken to resolve these network and access issues? (Select TWO.)

  1. Configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet to allow internet connectivity.Answer
  2. Ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions and that its trust policy allows the service principal codebuild.amazonaws.com to assume the role.Answer
  3. C
    Update the CodeBuild IAM service role's trust policy to allow secretsmanager.amazonaws.com to assume the role, allowing AWS Secrets Manager to push the credential into the build environment.
  4. D
    Migrate the database password to AWS Systems Manager Parameter Store as a Standard parameter, configure automatic rotation, and retrieve it using the parameter-store block in the buildspec.
  5. E
    Place the buildspec.yml file containing the secret configuration in a sub-folder named config/ within the repository without changing the default CodeBuild project buildspec settings.

Answer

To resolve the issues, configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet, and ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions with a trust policy allowing codebuild.amazonaws.com to assume the role.
The correct configuration requires routing outbound traffic from CodeBuild's private VPC subnets to a NAT gateway so that the build container can reach the public internet to download external dependencies. Additionally, the CodeBuild IAM service role must have secretsmanager:GetSecretValue permission and a trust policy that allows codebuild.amazonaws.com to assume the role, enabling CodeBuild to authenticate and retrieve the database password.

Step-by-Step Solution

1
Analyze the networking failure
Identify that CodeBuild containers configured to run within a VPC do not receive public IP addresses. Therefore, placing them in public subnets or subnets without NAT gateways will prevent them from accessing the public internet to download dependencies.
To fix internet access inside a VPC, the CodeBuild project must be configured with private subnets that route outbound traffic through a NAT gateway.
2
Analyze the authorization failure for the database password
Identify that CodeBuild relies on an IAM service role to perform API operations like retrieving Secrets Manager secrets. The role requires the permission to get the secret, and the role's trust policy must trust codebuild.amazonaws.com.
Configuring the IAM service role with the correct trust relationship and the secretsmanager:GetSecretValue permission enables the build process to retrieve the secret.

Key Concept

AWS CodeBuild VPC networking and service role configuration
Estimated Time:2m 30s
Rate this question

Topics

AWS CodeBuild

More questions from this topic