Examkin

Question

Difficulty: MediumAWS CodeBuild

A developer is setting up an AWS CodeBuild project for a microservice located in a subdirectory (`services/order-service`) of a monorepo. The build process needs to run tests that require a database password stored in AWS Secrets Manager, and it must use a custom build specification file located at `services/order-service/buildspec.yml`. During the initial build run, the build fails immediately because the build specification file cannot be found, and the developer realizes that the application also lacks permission to fetch the database password.

Which combination of actions must the developer take to resolve these issues? (Select two.)

  1. Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml.Answer
  2. Add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.Answer
  3. C
    Move the buildspec file to the root of the repository and rename it to buildspec-order.yml without updating the project settings.
  4. D
    Update the trust policy of the CodeBuild service role to allow the Secrets Manager service (secretsmanager.amazonaws.com) to assume the role.
  5. E
    Retrieve the database password in the buildspec env block using the parameter-store reference type.

Answer

Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml, and add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.
To fix the buildspec resolution issue, the developer must update the CodeBuild project settings to specify the custom path services/order-service/buildspec.yml, since CodeBuild expects buildspec.yml in the repository root by default. To resolve the permission issue, the developer must add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project so that it is authorized to retrieve the database credentials.

Step-by-Step Solution

1
Configure the CodeBuild project settings with the custom buildspec location.
CodeBuild searches for the buildspec at services/order-service/buildspec.yml instead of the default root path, successfully finding and executing it.
By default, CodeBuild expects the buildspec file to be named buildspec.yml and located in the root of the repository source directory. Any other configuration must be specified in the project settings.
2
Update the IAM service role permissions policy for the CodeBuild project.
The project gains permission to fetch the secret from Secrets Manager.
CodeBuild assumes a service role during execution. This role must have an identity-based policy allowing secretsmanager:GetSecretValue in order to read the credentials.

Key Concept

AWS CodeBuild buildspec configuration and IAM service role permissions.
Rate this question

Topics

AWS CodeBuild

More questions from this topic