Examkin

Question

Difficulty: HardAWS CodeBuild

A developer is configuring an AWS CodeBuild project that runs inside a private subnet of a VPC to perform integration tests against an internal Amazon RDS database. The build process must retrieve a database password stored as a SecureString parameter in Systems Manager Parameter Store. The developer stores the build commands in a custom file named `build_config.yml` inside a subdirectory named `specs/` in the source repository.

During the initial run, the build fails with an error indicating that the build specification cannot be found.

Which combination of actions will resolve the buildspec finding error and allow the build to retrieve the parameter?

  1. Update the Buildspec path to `specs/build_config.yml` in the CodeBuild project settings. Additionally, ensure the VPC has either a NAT Gateway or a VPC interface endpoint for Systems Manager configured.Answer
  2. B
    Move the `build_config.yml` file to the root of the repository and rename it to `buildspec.yml`. In the CodeBuild project settings, configure the Buildspec path to point to the `specs/` directory. Ensure that the CodeBuild service role has the `ssm:GetParameters` permission.
  3. C
    Modify the trust policy of the CodeBuild service role to allow the `ssm.amazonaws.com` service principal to assume the role. In the `build_config.yml` file, define a custom `run-as` parameter under the `pre_build` phase pointing to the CodeBuild service role.
  4. D
    In the CodeBuild project settings, change the environment variable type from Parameter Store to Secrets Manager. In the `build_config.yml` file, change the `env.parameter-store` block to `env.secrets-manager` and migrate the credential to AWS Secrets Manager, as Systems Manager Parameter Store is not supported in VPC-enabled builds.

Answer

Update the Buildspec path to `specs/build_config.yml` in the CodeBuild project settings. Additionally, ensure the VPC has either a NAT Gateway or a VPC interface endpoint for Systems Manager configured.
The correct answer resolves the buildspec finding failure by specifying the custom path in the CodeBuild project configuration. It also addresses the connectivity issue by establishing a valid network path from the private VPC subnet to the public Systems Manager API.

Step-by-Step Solution

1
Address the buildspec location error.
By default, AWS CodeBuild looks for a file named `buildspec.yml` at the root of the source directory. Since the developer used a custom filename and path, the CodeBuild project's Buildspec setting must be updated to match this path.
This resolves the initial phase failure where CodeBuild cannot find the build specification.
2
Analyze VPC network requirements for accessing public AWS services.
CodeBuild containers running inside a private subnet of a VPC do not have direct internet access. To interact with public AWS services like Systems Manager Parameter Store, they need a route to the internet or private VPC endpoints.
Without this routing configuration, the build container will time out or fail when attempting to fetch parameters from Systems Manager.

Key Concept

AWS CodeBuild custom buildspec paths and VPC network access to AWS services
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeBuild

More questions from this topic