Examkin

Question

Difficulty: MediumAWS CodeBuild

A developer is configuring a build project in AWS CodeBuild to package an application. The build process requires retrieving a non-sensitive database port number that rarely changes, and a database password that must be automatically rotated every 30 days. To optimize for cost, operational efficiency, and security, which configuration should the developer implement?

  1. Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.Answer
  2. B
    Store both the database port and the database password in AWS Secrets Manager, and retrieve them using the secrets-manager block under the env section of the buildspec.yml file.
  3. C
    Store both the database port and the database password in AWS Systems Manager Parameter Store, and retrieve them using the parameter-store block under the env section of the buildspec.yml file.
  4. D
    Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and add the required read permissions to the trust relationship policy document of the AWS CodeBuild service role.

Answer

Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.
Storing the port in Parameter Store is cost-effective because standard parameters are free. Storing the password in Secrets Manager meets the security requirement for automatic rotation. Referencing them in the parameter-store and secrets-manager blocks of the env section in the root buildspec.yml file allows CodeBuild to automatically fetch the values and inject them as environment variables during the build execution.

Step-by-Step Solution

1
Identify the security and operational requirements of the two variables.
The database port is non-sensitive and static, while the database password is sensitive and requires automatic rotation every 30 days.
This classification determines the most cost-effective and secure AWS service to store each parameter.
2
Select the appropriate storage service for each parameter type.
AWS Systems Manager Parameter Store is chosen for the database port to avoid costs. AWS Secrets Manager is chosen for the database password to support automatic rotation.
Parameter Store does not natively support rotation of secrets, while Secrets Manager is expensive for non-sensitive parameters.
3
Configure the retrieval mechanism in the build specification.
Reference the variables under their respective blocks (parameter-store and secrets-manager) in the env section of the root buildspec.yml file.
AWS CodeBuild natively supports retrieving values from both services during the build lifecycle when configured in the buildspec.

Key Concept

Retrieving configuration data and secrets in AWS CodeBuild using AWS Systems Manager Parameter Store and AWS Secrets Manager
Estimated Time:1m 30s
Rate this question

Topics

AWS CodeBuild

More questions from this topic