Examkin

Question

Difficulty: MediumAWS CodePipeline

A developer is configuring a continuous integration and continuous delivery (CI/CD) pipeline in AWS CodePipeline. The pipeline includes a test stage that invokes an AWS Lambda function to run integration tests against a database. The Lambda function requires database credentials to connect to the database and must notify CodePipeline of the success or failure of the tests. Which of the following actions should the developer perform to configure this setup securely and correctly? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and grant the Lambda function's IAM execution role permission to retrieve the secret.Answer
  2. Grant the Lambda function's IAM execution role permission to perform the codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult API operations.Answer
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a standard parameter and configure Parameter Store to automatically rotate the credentials.
  4. D
    Configure the trust policy of the Lambda function's IAM execution role to allow the CodePipeline service principal to assume the role using the sts:AssumeRole action.
  5. E
    Hardcode the database credentials directly in the Lambda function's initialization code and configure the AWS SDK client to use those credentials.

Answer

To configure this setup securely and correctly, the developer should store the database credentials in AWS Secrets Manager and grant the Lambda execution role permission to retrieve the secret. Additionally, the Lambda execution role must be granted permissions to call the codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult API operations to report the job status back to CodePipeline.
Storing database credentials in AWS Secrets Manager allows secure storage and automatic rotation of secrets. The Lambda execution role must be granted permissions to retrieve this secret to connect to the database. Additionally, when CodePipeline invokes a Lambda function, the function runs asynchronously and must report the outcome back to CodePipeline. The Lambda function's execution role requires permission to call codepipeline:PutJobSuccessResult and codepipeline:PutJobFailureResult to update the pipeline stage status.

Step-by-Step Solution

1
Determine the secure method for storing and retrieving database credentials.
Identify AWS Secrets Manager as the appropriate service because it supports built-in rotation and secure runtime retrieval, unlike Systems Manager Parameter Store standard parameters.
This prevents credentials from being hardcoded in code or configuration files, adhering to security best practices.
2
Determine the required permissions for CodePipeline integration with Lambda.
Identify that the Lambda function must report its execution status back to CodePipeline to mark the stage as success or failure using the PutJobSuccessResult or PutJobFailureResult API operations.
Lambda tasks in CodePipeline run asynchronously. CodePipeline expects the function to send a success or failure token to complete the job; otherwise, the pipeline stage will remain in progress until it times out.

Key Concept

When AWS CodePipeline invokes an AWS Lambda function, the Lambda function must report back success or failure using the PutJobSuccessResult or PutJobFailureResult API calls. Additionally, database credentials should be stored securely in AWS Secrets Manager rather than in Parameter Store (which lacks native rotation for standard parameters) or hardcoded.
Rate this question

Topics

AWS CodePipeline

More questions from this topic