Examkin

Question

Difficulty: MediumAWS CodeBuild

A company is migrating its build pipelines to AWS. A developer is setting up an AWS CodeBuild project that needs to run automated integration tests against a database. The build configuration requires retrieving a database password securely and using a custom build specification file named build-config.yml instead of the default buildspec.yml file.

Which combination of actions must the developer perform to successfully configure this build project? (Select TWO.)

  1. Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter, and reference it under the parameter-store mapping in the env section of build-config.yml.Answer
  2. In the AWS CodeBuild project configuration, specify build-config.yml in the buildspec build settings.Answer
  3. C
    Store the database password in AWS Systems Manager Parameter Store as a standard String parameter, and reference it under the variables mapping in the env section of build-config.yml.
  4. D
    Place the build-config.yml file inside a subdirectory named config/ in the repository without changing the project configuration, as CodeBuild automatically scans subdirectories for custom buildspec filenames.
  5. E
    Modify the trust policy of the CodeBuild service role to allow the Systems Manager service (ssm.amazonaws.com) to assume the role.

Answer

Store the database password as a SecureString in Parameter Store and reference it in the parameter-store section of the custom buildspec file, and specify the custom buildspec filename in the CodeBuild project settings.
To successfully configure this project, the developer must override the default buildspec filename in the AWS CodeBuild project configuration by setting it to build-config.yml. Additionally, the developer must store the password as a SecureString in Systems Manager Parameter Store and reference it in the parameter-store mapping of the env section in the buildspec file. This allows CodeBuild to decrypt and expose the password as an environment variable during the build phases securely.

Step-by-Step Solution

1
Configure the CodeBuild project to use the custom buildspec file.
Specify the name build-config.yml in the buildspec settings of the project configuration.
By default, CodeBuild looks for a file named buildspec.yml at the root of the source directory. A custom filename must be explicitly defined.
2
Secure the database password using Parameter Store.
Store the database password as a SecureString parameter in Systems Manager Parameter Store.
SecureString ensures the parameter is encrypted at rest using a KMS key, which is standard practice for sensitive credentials like passwords.
3
Reference the parameter securely in the build specification.
Add the parameter-store mapping under the env section of the buildspec and map the environment variable to the Parameter Store parameter name.
This allows CodeBuild to retrieve the decrypted value dynamically during the build execution without hardcoding it in the source repository.

Key Concept

AWS CodeBuild project configuration including custom buildspec overrides and secure parameter retrieval via Systems Manager Parameter Store.
Rate this question

Topics

AWS CodeBuild

More questions from this topic