Examkin

Question

Difficulty: HardAWS CodePipeline

A developer is configuring a continuous delivery pipeline in AWS CodePipeline that deploys a serverless application using AWS CloudFormation. The pipeline needs to pass a database password to the CloudFormation deploy stage. The database password must be rotated automatically every 30 days to comply with company security policies. Additionally, the CloudFormation action in CodePipeline must assume a specific deployment IAM role in the production account to create and update resources. Which configuration should the developer implement to meet these requirements securely and with the least operational overhead?

  1. A
    Store the database password in Systems Manager Parameter Store as a SecureString parameter and configure automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.
  2. Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.Answer
  3. C
    Store the database password in AWS Secrets Manager and enable automatic rotation. In the CodePipeline service role, add a permissions policy that allows the sts:AssumeRole action on the deployment IAM role, and leave the trust policy of the deployment IAM role blank.
  4. D
    Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure a permissions policy to allow the CodePipeline service principal to perform the sts:AssumeRole action, but do not modify the deployment role's trust policy.

Answer

Store the database password in AWS Secrets Manager and enable automatic rotation. In the deployment IAM role, configure the trust policy to allow the CodePipeline service principal to assume the role.
The correct configuration uses AWS Secrets Manager for secret storage because it offers built-in automatic rotation. In addition, to allow AWS CodePipeline to assume the deployment IAM role, the trust policy of the deployment role must be updated to allow the CodePipeline service principal to assume it. This satisfies all requirements with minimal operational overhead.

Step-by-Step Solution

1
Identify the database password rotation requirement.
Determine that AWS Secrets Manager is the correct service because it natively supports automatic rotation, unlike Systems Manager Parameter Store.
Parameter Store lacks native, automated rotation, which would require custom Lambda scripts, adding operational overhead.
2
Determine the required trust relationship for the deployment role.
Identify that the CloudFormation deployment IAM role needs to trust the CodePipeline service principal (codepipeline.amazonaws.com).
The deployment role must allow CodePipeline to assume it via a trust policy, which is distinct from a permissions policy.
3
Combine both configurations.
Choose the configuration that stores the secret in Secrets Manager and correctly modifies the trust policy of the deployment role.
This ensures both security compliance for secret rotation and correct delegation of IAM permissions.

Key Concept

Integrating AWS CodePipeline with AWS Secrets Manager and cross-account or cross-action IAM roles.
Rate this question

Topics

AWS CodePipeline

More questions from this topic