A developer is configuring a release pipeline in AWS CodePipeline. The pipeline must retrieve a database password that requires automatic weekly rotation, and it must assume an IAM role in a target AWS account to deploy resources. Which of the following configuration steps are correct? (Select TWO.)
- Store the database password in AWS Secrets Manager, which natively supports automatic rotation of database credentials.Answer
- BStore the database password in Systems Manager Parameter Store, as Parameter Store natively supports automatic rotation.
- Configure the trust policy of the target IAM role to allow the CodePipeline service role to assume it.Answer
- DConfigure the permission policy of the target IAM role to authorize which external accounts can assume the role.
- ECreate an IAM group and attach the CodePipeline service role to the group to manage cross-account permissions.
Answer
Store the database password in AWS Secrets Manager, which natively supports automatic rotation of database credentials, and configure the trust policy of the target IAM role to allow the CodePipeline service role to assume it.
Storing database credentials in AWS Secrets Manager is correct because it natively handles secrets and supports automatic weekly rotation. Additionally, configuring the trust policy of the target IAM role allows CodePipeline to assume the role and execute deployment actions in the target account.
Step-by-Step Solution
Key Concept
AWS CodePipeline integrates with Secrets Manager for secret retrieval and uses cross-account IAM role assumptions defined via trust policies to perform deployments.