Examkin

Question

Difficulty: MediumAWS CodePipeline

A developer is configuring a continuous release pipeline in AWS CodePipeline for a web application. The pipeline must include a manual approval stage before deploying the application to production, which should notify the operations team. Additionally, the subsequent build and deployment stage in AWS CodeBuild requires a database API key that must be rotated automatically every 30 days. Which combination of steps should the developer perform to meet these requirements securely? (Select TWO.)

  1. Create an Amazon SNS topic, subscribe the operations team's email addresses, and associate the SNS topic ARN with the manual approval action in CodePipeline.Answer
  2. Store the database API key in AWS Secrets Manager, enable automatic rotation, and retrieve the secret in the CodeBuild buildspec file using the Secrets Manager integration.Answer
  3. C
    Store the database API key in AWS Systems Manager Parameter Store as a SecureString parameter, configure automatic 30-day rotation on the parameter, and reference it in CodeBuild.
  4. D
    Modify the CodePipeline service role's trust policy to include the operations team's IAM user ARNs, enabling them to receive approval notifications directly.
  5. E
    Add the database API key plaintext value directly to the buildspec.yml file in the root of the source repository so CodeBuild can read it during the build.

Answer

Create an Amazon SNS topic, subscribe the operations team's email addresses, and associate it with the manual approval action; and store the database API key in AWS Secrets Manager with automatic rotation enabled, retrieving it during the build phase.
To satisfy the requirements, the developer must use an Amazon SNS topic subscribed to the operations team's email addresses and link it to the manual approval action. For the secret requiring rotation, storing the key in AWS Secrets Manager with automatic rotation enabled satisfies the 30-day rotation requirement and can be securely retrieved by CodeBuild at runtime.

Step-by-Step Solution

1
Determine the mechanism to notify the operations team of manual approvals in CodePipeline.
Identify Amazon SNS as the supported service for manual approval action notifications.
CodePipeline manual approval actions natively integrate with Amazon SNS to publish notification messages.
2
Evaluate secret storage options for the database API key requiring automatic rotation.
Select AWS Secrets Manager as the appropriate service for secret rotation.
Secrets Manager provides native automatic rotation capabilities, unlike Systems Manager Parameter Store.
3
Configure the build execution step to retrieve the secret securely.
Reference the Secrets Manager secret dynamically inside the buildspec.yml file.
Retrieving the secret at runtime prevents hardcoding sensitive credentials in source code or project settings.

Key Concept

AWS CodePipeline manual approvals and secure secret rotation integration with CodeBuild
Rate this question

Topics

AWS CodePipeline

More questions from this topic