A developer is configuring a continuous delivery pipeline in AWS CodePipeline. The pipeline builds a database migration package in AWS CodeBuild and then runs a post-migration check using an AWS Lambda function. The CodeBuild project must retrieve a database password stored as a SecureString in AWS Systems Manager Parameter Store. The Lambda function must report its execution status back to CodePipeline.
Arrange the execution steps in the correct chronological order from start to finish to ensure the pipeline runs successfully without permission or credential failures.
- 1CodePipeline pulls the latest code from the repository and creates the source artifact.
- 2AWS CodeBuild assumes its service role, retrieves the SecureString parameter from Systems Manager Parameter Store, and decrypts it using AWS KMS.
- 3AWS Lambda assumes its execution role via the trusted service principal to execute the verification code.
- 4The Lambda function sends a success token back to CodePipeline via the PutJobSuccessResult API call.
Answer
The pipeline first pulls the source code, then CodeBuild retrieves and decrypts the database password from Parameter Store, next the Lambda service assumes the Lambda execution role to run, and finally the Lambda function invokes PutJobSuccessResult to notify CodePipeline of completion.
The correct order requires pulling the source code first, then allowing CodeBuild to assume its service role and decrypt the SecureString from Parameter Store using AWS KMS. After CodeBuild completes, CodePipeline invokes the Lambda function. The Lambda service assumes the execution role (which requires a trust relationship with lambda.amazonaws.com), and once the code runs, the function must explicitly report success to CodePipeline using PutJobSuccessResult.
Step-by-Step Solution
Key Concept
AWS CodePipeline execution flow, secure parameter retrieval, and service role trust configurations.
Estimated Time:1m 30s