Examkin

Question

Difficulty: MediumAWS CodeBuild

A developer is configuring an AWS CodeBuild project to package a web application. The build process requires retrieving a database connection string from AWS Systems Manager Parameter Store and using a custom IAM role to allow CodeBuild to write the build logs to an Amazon CloudWatch Logs log group. During the first build run, the build fails immediately before the install phase with an error stating that CodeBuild is not authorized to assume the service role. Additionally, the application fails to build because the connection string path is being treated as a literal string rather than retrieving the actual database connection string value. Which of the following actions should the developer take to resolve these issues? (Select TWO.)

  1. Update the trust policy of the custom IAM role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  2. In the buildspec.yml file, define the database connection string environment variable under the parameter-store mapping in the env section.Answer
  3. C
    Attach an identity-based permission policy to the custom IAM role that allows the sts:AssumeRole action on all resources, and set the principal to a wildcard (*).
  4. D
    Migrate the database connection string to AWS Secrets Manager, as Systems Manager Parameter Store does not support retrieval of configuration values in buildspec.yml files.
  5. E
    Move the buildspec.yml file from the root directory of the repository to a new subdirectory named /env to allow the environment variables to be parsed.

Answer

To resolve these issues, the developer must update the trust policy of the custom IAM role to allow the AWS CodeBuild service principal to assume the role, and define the parameter under the parameter-store mapping in the buildspec.yml file.
The correct actions are updating the trust policy of the custom IAM role to trust the codebuild.amazonaws.com service principal and defining the Parameter Store variables under the parameter-store block of the env section in the buildspec.yml. This allows CodeBuild to assume the service role and resolve the parameter path into the actual connection string value.

Step-by-Step Solution

1
Inspect and update the trust relationship of the custom IAM role.
The IAM role's trust policy is configured to trust 'codebuild.amazonaws.com', allowing CodeBuild to successfully assume the role.
CodeBuild needs explicit assume role permissions in the trust policy of any custom service role it uses.
2
Update the environment variable section of the buildspec.yml.
The database connection string is placed under the 'parameter-store' mapping within the 'env' section of the buildspec.
Placing the variable under 'parameter-store' instructs CodeBuild to fetch the actual value from Systems Manager Parameter Store instead of treating the path as a static string.

Key Concept

AWS CodeBuild IAM service role trust relationships and environment variable retrieval from Systems Manager Parameter Store.
Rate this question

Topics

AWS CodeBuild

More questions from this topic