Examkin

Question

Difficulty: MediumAWS CodeBuild

A developer is setting up an AWS CodeBuild project that needs to pull dependency packages from a third-party private repository. The credentials for this repository must be rotated automatically every 30 days. The developer needs to configure the build environment to securely retrieve these credentials during the build process.

Which configuration should the developer implement to meet these requirements with the lowest operational overhead?

  1. A
    Store the credentials as a SecureString parameter in Systems Manager Parameter Store. Reference the parameter using the parameter-store mapping under the env sequence in the buildspec.yml file.
  2. Store the credentials in AWS Secrets Manager with automatic rotation. In the buildspec.yml file, reference the secret using the secrets-manager mapping under the env sequence.Answer
  3. C
    Store the credentials in AWS Secrets Manager with automatic rotation. Update the CodeBuild service role's trust policy to include an Allow statement for the secretsmanager.amazonaws.com service principal.
  4. D
    Store the credentials in a buildspec.yml file located in the project's subfolder /configuration and configure CodeBuild to automatically search the directory structure to locate and run the build specification.

Answer

Store the credentials in AWS Secrets Manager with automatic rotation. In the buildspec.yml file, reference the secret using the secrets-manager mapping under the env sequence.
Storing the credentials in AWS Secrets Manager is the correct approach because it natively supports automatic rotation of secrets. Referencing the secret in the env/secrets-manager section of the buildspec.yml file allows CodeBuild to securely retrieve the credentials at build time without exposing them in plaintext.

Step-by-Step Solution

1
Select the appropriate storage service for secrets requiring automatic rotation.
AWS Secrets Manager is chosen because it supports built-in automatic rotation using AWS Lambda, whereas Systems Manager Parameter Store does not.
Meeting the rotation requirement with the lowest operational overhead requires utilizing native service features.
2
Configure reference to the stored secret in the build definition.
Add the secret under the env/secrets-manager section of the buildspec.yml file.
This allows CodeBuild to fetch the credential dynamically at runtime, avoiding hardcoded values.
3
Ensure correct IAM permissions are attached to the CodeBuild service role.
Attach a policy with the secretsmanager:GetSecretValue permission to the CodeBuild execution role.
CodeBuild needs permission to retrieve the secret value from Secrets Manager during the build execution.

Key Concept

Secure credential retrieval and buildspec configuration in AWS CodeBuild
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeBuild

More questions from this topic