Examkin

Question

Difficulty: Very hardAWS CodeBuild

A developer is configuring an AWS CodeBuild project that must run within a private subnet of a VPC to perform integration tests against a private Amazon RDS PostgreSQL database. The build process needs to retrieve an encrypted database password from AWS Systems Manager Parameter Store and pull a base image from a private Amazon ECR repository located in a shared-services AWS account. During the build execution, the build fails in the early phases with connection timeouts and permission errors. Which combination of actions should the developer take to resolve these issues? (Select TWO.)

  1. Ensure the CodeBuild project is associated with private subnets that route outbound traffic through a NAT Gateway, or configure Interface VPC endpoints within the VPC for Systems Manager and Amazon ECR.Answer
  2. Grant the CodeBuild service role the ssm:GetParameters and kms:Decrypt permissions for the parameter and its custom KMS key, and retrieve the password using the env: parameter-store block in the buildspec.Answer
  3. C
    Attach an IAM policy to the CodeBuild service role that grants the ecr:GetAuthorizationToken permission restricted to the specific Amazon ECR repository ARN in the shared-services account.
  4. D
    Retrieve the database password by listing it under the env: variables block in the buildspec, and grant the CodeBuild service role the ssm:GetParameter permission.
  5. E
    Place the buildspec.yml file within a .aws/ subdirectory at the root of the repository, and configure the project to use a custom service role that assumes the Parameter Store administrator role.

Answer

Configure private subnets with a NAT Gateway or VPC endpoints to establish connectivity, and retrieve the SecureString parameter via the env: parameter-store block while granting the service role both ssm:GetParameters and kms:Decrypt permissions.
For CodeBuild to communicate with AWS services when running inside a VPC, it requires route paths either via a NAT Gateway inside private subnets or Interface VPC endpoints. For SecureString parameters, the parameters must be retrieved using the env: parameter-store block, and the service role must be granted ssm:GetParameters and kms:Decrypt permissions.

Step-by-Step Solution

1
Diagnose the network timeout error during the early build phases.
Identify that CodeBuild containers launched inside a VPC do not have route paths to external AWS service public endpoints (like Systems Manager or Amazon ECR) by default.
Establishing outbound paths via a NAT Gateway or using local Interface VPC Endpoints inside the VPC is required for VPC-enabled CodeBuild projects to access external resources.
2
Address the Systems Manager Parameter Store access configuration.
Map the parameter inside the env: parameter-store section of the buildspec file rather than env: variables.
Only env: parameter-store triggers CodeBuild to retrieve and decrypt SecureString values from Systems Manager Parameter Store during the build lifecycle.
3
Grant the necessary IAM permissions to the CodeBuild service role.
Ensure the role has ssm:GetParameters and kms:Decrypt permissions for the custom KMS customer managed key (CMK) used to encrypt the password.
AWS-managed default KMS keys cannot be shared across accounts if cross-account access is needed, and accessing custom keys requires explicit ssm and kms permissions.

Key Concept

Configuring AWS CodeBuild VPC connectivity, ECR access, and IAM service role permissions to decrypt SecureString parameters in a buildspec.
Estimated Time:3m 0s
Rate this question

Topics

AWS CodeBuild

More questions from this topic