Examkin

Question

Difficulty: HardAWS CodeBuild

An organization's monorepo structure places the build configuration for the payment module in a file named buildspec-payment.yml inside the /services/payment/ directory. The module requires a payment gateway API key that is securely stored in AWS Secrets Manager. During the build, CodeBuild fails to locate the build configuration, and the application cannot retrieve the API key. Which two steps must be performed to resolve these failures? (Select TWO.)

  1. Configure the buildspec path in the CodeBuild project settings to point directly to services/payment/buildspec-payment.yml.Answer
  2. Define the API key variable under the secrets-manager block in the env phase of the buildspec, and grant the CodeBuild service role the secretsmanager:GetSecretValue permission.Answer
  3. C
    Change the buildspec file name to buildspec.yml and keep it in the /services/payment/ directory, because CodeBuild automatically searches all subdirectories for files named buildspec.yml.
  4. D
    Modify the trust relationship of the CodeBuild service role to grant the Secrets Manager service principal (secretsmanager.amazonaws.com) permission to assume the role.
  5. E
    Define the API key variable under the parameter-store block in the env phase of the buildspec, and grant the CodeBuild service role the ssm:GetParameters permission.

Answer

To resolve the build failures, the buildspec path in the CodeBuild project settings must be updated to services/payment/buildspec-payment.yml, and the API key must be retrieved using the secrets-manager block under the env section of the buildspec, with the service role granted the secretsmanager:GetSecretValue permission.
Updating the project settings with the exact custom path allows CodeBuild to find the buildspec. Referencing the secret in the secrets-manager block in the env phase, combined with the secretsmanager:GetSecretValue API permissions in the execution role, allows CodeBuild to retrieve the API key.

Step-by-Step Solution

1
Configure the custom buildspec location
CodeBuild will correctly read the buildspec-payment.yml file located in the subdirectory during the initialization phase.
By default, CodeBuild only scans the root folder for buildspec.yml. A path override is required for subdirectories or custom file names.
2
Update the buildspec environment section
CodeBuild natively parses the API key from AWS Secrets Manager and sets it as an environment variable.
Specifying the secrets-manager block under the env phase allows CodeBuild to automatically fetch the secret during the build run.
3
Grant the necessary IAM permissions to the CodeBuild service role
The API key is successfully decrypted and made available to the build script.
Without secretsmanager:GetSecretValue permissions, CodeBuild cannot decrypt the secret, causing the build to fail.

Key Concept

AWS CodeBuild project configurations for custom buildspec paths and integration with AWS Secrets Manager
Rate this question

Topics

AWS CodeBuild

More questions from this topic