Examkin

AWS CodeBuild

31 questions

All types31Multiple choice15Multiple select16
Question 1Question →

A developer is setting up an AWS CodeBuild project to compile a Java application and upload the build artifacts to an Amazon S3 bucket. During the first build execution, CodeBuild fails to upload the artifacts, returning an Access Denied error. Additionally, the developer wants the project to use a custom build specification file named build-config.yml located in the config directory of the repository, rather than using the default root-level buildspec.yml file.

Which configuration steps must the developer perform to resolve the upload failure and use the custom build specification? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the buildspec path in the CodeBuild project settings to config/build-config.yml.; Modify the CodeBuild service role permissions policy to allow the s3:PutObject action on the artifacts bucket.

Answer

The correct steps are to update the buildspec path in the CodeBuild project settings to point to the custom path, and to modify the CodeBuild service role permissions policy to allow writing objects to the S3 bucket.
To use a custom build specification file that is not in the root directory or has a different name, the developer must configure the file path in the project settings. Additionally, since the build environment failed to upload the artifacts to Amazon S3 with an Access Denied error, the CodeBuild service role must be updated with a policy that allows the write action on the target S3 bucket.

Step-by-Step Solution

1
Determine how CodeBuild locates a non-standard buildspec file name and path.
A custom buildspec path like config/build-config.yml must be configured directly within the CodeBuild project settings.
By default, CodeBuild expects buildspec.yml in the root directory. Any custom path or name must be specified in the project configuration.
2
Analyze the cause of the Access Denied error during artifact upload.
The CodeBuild build container runs under an IAM role (the service role). It requires explicit permissions to write objects to the S3 bucket where artifacts are stored.
Without s3:PutObject permissions attached to the CodeBuild service role, the upload will fail with an authorization error.

Key Concept

AWS CodeBuild custom buildspecs and permissions
Question 2Question →

A developer is setting up an AWS CodeBuild project to build a containerized application. The build process needs to retrieve a database password securely from AWS Secrets Manager. The developer has stored a custom build specification file at the path `build/pipelines/buildspec-dev.yml` in the source repository. During the initial build run, CodeBuild fails immediately because it cannot locate the build specification, and the database credentials are not resolved. Which two actions should the developer take to configure the project correctly? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Update the CodeBuild project configuration to set the buildspec file path to build/pipelines/buildspec-dev.yml; In the buildspec-dev.yml file, retrieve the database password by defining it under the secrets-manager key in the env section

Answer

To configure the project correctly, the developer must update the CodeBuild project settings to set the buildspec path to the custom subdirectory path, and update the buildspec-dev.yml file to declare the secret under the secrets-manager key in the env section.
To resolve the buildspec locator issue, the developer must explicitly configure the custom file path in the CodeBuild project configuration since it is not named buildspec.yml at the root. To retrieve the secret correctly, the developer must define it under the secrets-manager key in the env block, which instructs CodeBuild to retrieve the value from Secrets Manager natively.

Step-by-Step Solution

1
Configure the CodeBuild project settings to point to the correct buildspec location.
CodeBuild is successfully able to locate and parse the buildspec file from build/pipelines/buildspec-dev.yml instead of failing at the start of the build.
By default, CodeBuild only searches for buildspec.yml at the root directory of the source provider. Any other name or path must be configured in the project settings.
2
Configure the env section of the buildspec-dev.yml file to pull the database password from Secrets Manager.
The database password is dynamically retrieved and exposed as an environment variable in the build environment.
Using the native secrets-manager key in the env block tells CodeBuild to fetch the secret from AWS Secrets Manager using the service role's permissions.

Key Concept

AWS CodeBuild buildspec configuration and Secrets Manager integration
Question 3Question →

A developer is configuring an AWS CodeBuild project to package a web application. The build process requires retrieving a database connection string from AWS Systems Manager Parameter Store and using a custom IAM role to allow CodeBuild to write the build logs to an Amazon CloudWatch Logs log group. During the first build run, the build fails immediately before the install phase with an error stating that CodeBuild is not authorized to assume the service role. Additionally, the application fails to build because the connection string path is being treated as a literal string rather than retrieving the actual database connection string value. Which of the following actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Update the trust policy of the custom IAM role to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.; In the buildspec.yml file, define the database connection string environment variable under the parameter-store mapping in the env section.

Answer

To resolve these issues, the developer must update the trust policy of the custom IAM role to allow the AWS CodeBuild service principal to assume the role, and define the parameter under the parameter-store mapping in the buildspec.yml file.
The correct actions are updating the trust policy of the custom IAM role to trust the codebuild.amazonaws.com service principal and defining the Parameter Store variables under the parameter-store block of the env section in the buildspec.yml. This allows CodeBuild to assume the service role and resolve the parameter path into the actual connection string value.

Step-by-Step Solution

1
Inspect and update the trust relationship of the custom IAM role.
The IAM role's trust policy is configured to trust 'codebuild.amazonaws.com', allowing CodeBuild to successfully assume the role.
CodeBuild needs explicit assume role permissions in the trust policy of any custom service role it uses.
2
Update the environment variable section of the buildspec.yml.
The database connection string is placed under the 'parameter-store' mapping within the 'env' section of the buildspec.
Placing the variable under 'parameter-store' instructs CodeBuild to fetch the actual value from Systems Manager Parameter Store instead of treating the path as a static string.

Key Concept

AWS CodeBuild IAM service role trust relationships and environment variable retrieval from Systems Manager Parameter Store.
Question 4Question →

A developer is configuring an AWS CodeBuild project for a repository that contains multiple build configurations. The developer needs the project to use a custom build specification file named `buildspec-dev.yml` located inside a nested folder named `config`. How should the developer configure CodeBuild to locate this file?

Show answer & explanation

Answer: Specify the relative path to the file, `config/buildspec-dev.yml`, in the buildspec override setting of the CodeBuild project configuration.

Answer

Specify the relative path to the file, `config/buildspec-dev.yml`, in the buildspec override setting of the CodeBuild project configuration.
To use a buildspec file that has a custom name or is not located in the root of the source directory, the developer must specify the relative path to the file in the buildspec override setting of the CodeBuild project configuration. This instructs CodeBuild where to look for the file within the source code repository.

Step-by-Step Solution

1
Identify the default behavior of AWS CodeBuild regarding the buildspec file.
By default, AWS CodeBuild looks for a file named `buildspec.yml` in the root directory of the source provider.
This is the default convention for running builds without extra configuration.
2
Determine how to modify the buildspec file name or location.
AWS CodeBuild provides a 'buildspec override' configuration option at the project level.
This configuration allows developers to specify a custom buildspec file name or path relative to the root of the source directory.
3
Apply the custom path to the CodeBuild project settings.
Enter the relative path `config/buildspec-dev.yml` in the project's buildspec settings.
This tells CodeBuild exactly where to locate the configuration file for the build execution.

Key Concept

AWS CodeBuild supports overriding the default buildspec file name and location by configuring the buildspec path relative to the repository root.
Estimated Time:1m 0s
Question 5Question →

An organization's monorepo structure places the build configuration for the payment module in a file named buildspec-payment.yml inside the /services/payment/ directory. The module requires a payment gateway API key that is securely stored in AWS Secrets Manager. During the build, CodeBuild fails to locate the build configuration, and the application cannot retrieve the API key. Which two steps must be performed to resolve these failures? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the buildspec path in the CodeBuild project settings to point directly to services/payment/buildspec-payment.yml.; Define the API key variable under the secrets-manager block in the env phase of the buildspec, and grant the CodeBuild service role the secretsmanager:GetSecretValue permission.

Answer

To resolve the build failures, the buildspec path in the CodeBuild project settings must be updated to services/payment/buildspec-payment.yml, and the API key must be retrieved using the secrets-manager block under the env section of the buildspec, with the service role granted the secretsmanager:GetSecretValue permission.
Updating the project settings with the exact custom path allows CodeBuild to find the buildspec. Referencing the secret in the secrets-manager block in the env phase, combined with the secretsmanager:GetSecretValue API permissions in the execution role, allows CodeBuild to retrieve the API key.

Step-by-Step Solution

1
Configure the custom buildspec location
CodeBuild will correctly read the buildspec-payment.yml file located in the subdirectory during the initialization phase.
By default, CodeBuild only scans the root folder for buildspec.yml. A path override is required for subdirectories or custom file names.
2
Update the buildspec environment section
CodeBuild natively parses the API key from AWS Secrets Manager and sets it as an environment variable.
Specifying the secrets-manager block under the env phase allows CodeBuild to automatically fetch the secret during the build run.
3
Grant the necessary IAM permissions to the CodeBuild service role
The API key is successfully decrypted and made available to the build script.
Without secretsmanager:GetSecretValue permissions, CodeBuild cannot decrypt the secret, causing the build to fail.

Key Concept

AWS CodeBuild project configurations for custom buildspec paths and integration with AWS Secrets Manager
Question 6Question →

A development team has configured an AWS CodeBuild project to run inside a private subnet of a VPC. During the build execution, the project fails because it cannot download external package dependencies from the internet. Additionally, subsequent runs are taking a long time because the dependencies are fully downloaded from scratch each time. Which two actions should the developer take to resolve the internet connectivity issue and speed up the builds? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route 0.0.0.0/00.0.0.0/0 traffic through the NAT gateway.; Enable local dependency caching in the CodeBuild project settings, and specify the package manager's cache directory in the `cache` section of the `buildspec.yml` file.

Answer

Configure a NAT gateway in a public subnet of the VPC, update the private subnet's route table to route traffic through the NAT gateway, enable local dependency caching in CodeBuild, and define the cache directories in the cache section of the buildspec file.
To resolve the issues, the developer must configure a NAT gateway in a public subnet and route outbound traffic from the private subnet to it. This provides the necessary internet access for CodeBuild to download external dependencies. Additionally, the developer must enable local caching in CodeBuild and define the target cache paths in the buildspec file. This ensures that dependencies are reused across builds instead of being downloaded from scratch.

Step-by-Step Solution

1
Address the outbound internet connectivity problem for resources inside the private subnet of the VPC.
Create a NAT gateway in a public subnet, and configure a route pointing 0.0.0.0/00.0.0.0/0 traffic to it in the private subnet's route table.
CodeBuild containers inside a private subnet cannot directly reach the internet to download external dependencies without a NAT gateway.
2
Implement a caching mechanism to avoid downloading dependencies from scratch on every run.
Configure local caching in CodeBuild project properties and add the cache directories (such as package manager cache folders) to the cache phase of the buildspec file.
This allows CodeBuild to persist downloaded files between build runs, significantly speeding up execution times.

Key Concept

AWS CodeBuild VPC network routing and local dependency caching configurations
Question 7Question →

A developer is configuring a build in AWS CodeBuild that must retrieve an encrypted database password from the Systems Manager Parameter Store. The developer places a custom build specification file named build-config.yml inside a subdirectory named config in the source repository. When the build is triggered, CodeBuild fails with an error indicating that the buildspec file cannot be found. Additionally, once the buildspec is resolved, the build needs to be able to fetch and decrypt the password from Parameter Store.

Which TWO actions should the developer take to resolve these issues and ensure the build completes successfully?

Select all that apply

Show answer & explanation

Answer: Update the CodeBuild project settings to specify the buildspec path as config/build-config.yml.; Add the ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.

Answer

To resolve the issues, the developer must configure the custom buildspec path as config/build-config.yml in the CodeBuild project settings, and add both ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.
Specifying the custom buildspec path config/build-config.yml in the project settings tells CodeBuild where to locate the configuration file. Granting ssm:GetParameters and kms:Decrypt to the CodeBuild service role provides the necessary permissions to read and decrypt the secure parameter.

Step-by-Step Solution

1
Address the missing buildspec file issue.
Configured the project to look at config/build-config.yml instead of the default root path.
CodeBuild defaults to looking for buildspec.yml at the root directory. Subdirectories require explicit path mapping.
2
Configure Systems Manager Parameter Store permissions.
Added ssm:GetParameters to the CodeBuild service role.
Allows CodeBuild to retrieve the parameter value from Systems Manager Parameter Store.
3
Configure AWS Key Management Service (KMS) permissions.
Added kms:Decrypt to the CodeBuild service role.
Since the parameter is stored as a SecureString, CodeBuild needs decrypt permissions for the KMS key that encrypts it.

Key Concept

AWS CodeBuild buildspec configuration and IAM permissions for Systems Manager integration.
Question 8Question →

A developer is configuring an AWS CodeBuild project that must run within a private subnet of a VPC to perform integration tests against a private Amazon RDS PostgreSQL database. The build process needs to retrieve an encrypted database password from AWS Systems Manager Parameter Store and pull a base image from a private Amazon ECR repository located in a shared-services AWS account. During the build execution, the build fails in the early phases with connection timeouts and permission errors. Which combination of actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Ensure the CodeBuild project is associated with private subnets that route outbound traffic through a NAT Gateway, or configure Interface VPC endpoints within the VPC for Systems Manager and Amazon ECR.; Grant the CodeBuild service role the ssm:GetParameters and kms:Decrypt permissions for the parameter and its custom KMS key, and retrieve the password using the env: parameter-store block in the buildspec.

Answer

Configure private subnets with a NAT Gateway or VPC endpoints to establish connectivity, and retrieve the SecureString parameter via the env: parameter-store block while granting the service role both ssm:GetParameters and kms:Decrypt permissions.
For CodeBuild to communicate with AWS services when running inside a VPC, it requires route paths either via a NAT Gateway inside private subnets or Interface VPC endpoints. For SecureString parameters, the parameters must be retrieved using the env: parameter-store block, and the service role must be granted ssm:GetParameters and kms:Decrypt permissions.

Step-by-Step Solution

1
Diagnose the network timeout error during the early build phases.
Identify that CodeBuild containers launched inside a VPC do not have route paths to external AWS service public endpoints (like Systems Manager or Amazon ECR) by default.
Establishing outbound paths via a NAT Gateway or using local Interface VPC Endpoints inside the VPC is required for VPC-enabled CodeBuild projects to access external resources.
2
Address the Systems Manager Parameter Store access configuration.
Map the parameter inside the env: parameter-store section of the buildspec file rather than env: variables.
Only env: parameter-store triggers CodeBuild to retrieve and decrypt SecureString values from Systems Manager Parameter Store during the build lifecycle.
3
Grant the necessary IAM permissions to the CodeBuild service role.
Ensure the role has ssm:GetParameters and kms:Decrypt permissions for the custom KMS customer managed key (CMK) used to encrypt the password.
AWS-managed default KMS keys cannot be shared across accounts if cross-account access is needed, and accessing custom keys requires explicit ssm and kms permissions.

Key Concept

Configuring AWS CodeBuild VPC connectivity, ECR access, and IAM service role permissions to decrypt SecureString parameters in a buildspec.
Estimated Time:3m 0s
Question 9Question →

A software engineer is setting up a new build configuration in AWS CodeBuild for a web application. The engineer wants CodeBuild to automatically find the build commands and phases without specifying a custom path in the build project settings.

Where should the build specification file be placed by default, and what must it be named?

Show answer & explanation

Answer: In the root of the source directory, named buildspec.yml

Answer

In the root of the source directory, named buildspec.yml
The correct answer is the option stating that the file must be placed in the root of the source directory and named buildspec.yml. AWS CodeBuild expects the build specification file to be in the root directory and named buildspec.yml by default, unless a custom file name or location is overridden in the build project settings.

Step-by-Step Solution

1
Identify the default build specification file naming convention for AWS CodeBuild.
The file must be named buildspec.yml.
AWS CodeBuild looks specifically for a file named buildspec.yml by default.
2
Determine the default directory location for this file within the source repository.
The file must be placed in the root of the source directory.
CodeBuild fails to locate the build phases if the file is placed in a subdirectory unless a custom path is configured.

Key Concept

AWS CodeBuild default buildspec location and naming convention
Estimated Time:45s
Question 10Question →

An application team is configuring AWS CodeBuild to compile and package a Java application. The build process requires a buildspec file to define the build phases and must retrieve a database connection string stored in AWS Systems Manager Parameter Store. Which of the following actions should the developer take to meet these requirements? (Select TWO)

Select all that apply

Show answer & explanation

Answer: Place the buildspec.yml file in the root directory of the application source code.; Reference the database connection string under the parameter-store mapping of the env sequence in the buildspec file.

Answer

Place the buildspec.yml file in the root directory of the application source code, and reference the database connection string under the parameter-store mapping of the env sequence in the buildspec file.
The correct options are placing the buildspec.yml in the root directory of the source code and referencing the database connection string under the parameter-store mapping in the env sequence. By default, CodeBuild automatically looks for buildspec.yml at the root level of the source directory. To securely load secrets or configuration details from Systems Manager Parameter Store during the build, the developer must declare them under 'parameter-store' in the 'env' section of the buildspec, which maps the Parameter Store keys to environment variables in the build environment.

Step-by-Step Solution

1
Determine the default location of the build configuration file.
Confirm that the buildspec.yml file should be placed in the root directory of the source code.
AWS CodeBuild looks for the buildspec.yml file at the root of the source directory by default unless overridden in the project configuration.
2
Determine how to retrieve parameter values from AWS Systems Manager Parameter Store inside the buildspec file.
Declare the parameters under the parameter-store block in the env sequence of the buildspec file.
This allows CodeBuild to automatically fetch the values from Systems Manager Parameter Store and expose them as environment variables during the build phases.

Key Concept

AWS CodeBuild configuration requires the buildspec.yml file to be placed in the root of the source code by default, and Systems Manager Parameter Store variables must be declared under the parameter-store mapping in the env block.
Question 11Question →

A developer is setting up a build process in AWS CodeBuild that requires a database password and a software license key. The database password must be rotated automatically on a regular schedule, whereas the license key is a static configuration parameter that does not require rotation. The developer wants to retrieve these values securely during the build phase.

Which combination of steps will meet these requirements in the most secure and cost-effective manner? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it in the env/secrets-manager section of the buildspec file.; Store the license key in AWS Systems Manager Parameter Store and reference it in the env/parameter-store section of the buildspec file.

Answer

Store the database password in AWS Secrets Manager and reference it in the env/secrets-manager section of the buildspec file, and store the license key in AWS Systems Manager Parameter Store and reference it in the env/parameter-store section of the buildspec file.
Storing the database password in AWS Secrets Manager enables native, automatic rotation of the credential, which can be securely fetched at build time by referencing it in the env/secrets-manager section of the buildspec file. For the static license key, AWS Systems Manager Parameter Store is a cost-effective and secure solution that does not require rotation, and can be retrieved using the env/parameter-store section of the buildspec file.

Step-by-Step Solution

1
Analyze rotation requirements for the sensitive data.
The database password requires automatic rotation, making AWS Secrets Manager the ideal service. The software license key is static and does not require rotation, making AWS Systems Manager Parameter Store a more cost-effective option.
Choosing the correct storage service based on rotation needs optimizes security and cost.
2
Identify how AWS CodeBuild references these external configurations in the buildspec file.
Secrets Manager secrets are referenced in the env/secrets-manager section, and Parameter Store parameters are referenced in the env/parameter-store section.
Using the native CodeBuild buildspec environment syntax ensures the secrets are fetched securely at runtime during the build.

Key Concept

AWS CodeBuild environment variable retrieval from Secrets Manager and Systems Manager Parameter Store
Estimated Time:50s
Question 12Question →

A developer creates a new AWS CodeBuild project and configures a custom IAM role for the build environment. However, when attempting to run the build, the execution fails immediately before starting any phases with an error indicating that CodeBuild is unable to assume the configured service role. Which of the following is the most likely cause of this failure?

Show answer & explanation

Answer: The trust policy of the custom IAM role does not grant the codebuild.amazonaws.com service principal permission to assume the role.

Answer

The trust policy of the custom IAM role does not grant the codebuild.amazonaws.com service principal permission to assume the role.
For AWS CodeBuild to execute a build project, it must assume the specified IAM service role. This requires the IAM role's trust policy (trust relationship) to explicitly list the CodeBuild service principal (codebuild.amazonaws.com) in the Principal block and allow the sts:AssumeRole action. If the trust policy is missing or misconfigured, CodeBuild will fail to assume the role and the build cannot start.

Step-by-Step Solution

1
Analyze the error message regarding the inability to assume the service role.
Identify that the issue is related to the relationship between the service (AWS CodeBuild) and the IAM role.
Before any build phases can run, CodeBuild must assume the service role to obtain temporary security credentials.
2
Verify where service trust is established in AWS IAM.
Recognize that service trust is defined in the trust policy (or trust relationship) of the role, rather than its permissions policy.
The trust policy determines which entities (users, accounts, or services) are allowed to assume the role.
3
Identify the correct service principal for AWS CodeBuild.
Ensure that the principal 'codebuild.amazonaws.com' is configured to allow 'sts:AssumeRole'.
If this configuration is missing, IAM blocks CodeBuild from assuming the role, resulting in an immediate failure.

Key Concept

AWS CodeBuild IAM service role trust relationship
Question 13Question →

A company's CI/CD pipeline uses AWS CodeBuild to compile a web application. The build process requires the main application source code from a primary AWS CodeCommit repository, as well as a common stylesheet template from a secondary AWS CodeCommit repository. The developer configures the CodeBuild project with multiple input sources, setting the secondary source identifier to CommonStyles. During the build, the buildspec must copy the stylesheet from the secondary source directory to the main application's public assets folder. How should the developer reference the file path of the secondary source inside the buildspec.yml file to perform this copy operation?

Show answer & explanation

Answer: Reference the directory path using the `$CODEBUILD_SRC_DIR_CommonStyles` environment variable.

Answer

Reference the directory path using the `$CODEBUILD_SRC_DIR_CommonStyles` environment variable.
When configured with multiple input sources, AWS CodeBuild downloads the primary source to the default build directory referenced by `CODEBUILDSRCDIR‘.Foreachsecondarysource,CodeBuildcreatesaseparatedirectoryandgeneratesadedicatedenvironmentvariablenamed‘CODEBUILD_SRC_DIR`. For each secondary source, CodeBuild creates a separate directory and generates a dedicated environment variable named ` CODEBUILD_SRC_DIR_source_identifier` where `source_identifier` is the unique identifier specified in the project configuration. Therefore, referencing `$CODEBUILD_SRC_DIR_CommonStyles` provides the correct path to the secondary source repository's files.

Step-by-Step Solution

1
Identify how AWS CodeBuild handles multiple input sources during a build execution.
The primary source is downloaded to the directory referenced by `$CODEBUILD_SRC_DIR`, while secondary sources are downloaded to separate locations.
Understanding the isolation of source directories prevents incorrect assumptions about directory nesting or relative paths.
2
Determine how CodeBuild exposes the paths of secondary sources to the build environment.
CodeBuild dynamically generates environment variables for each secondary source matching the pattern `$CODEBUILD_SRC_DIR_source_identifier`.
This allows buildspec shell commands to programmatically locate and reference files across different repositories.
3
Select the specific environment variable matching the configured source identifier CommonStyles.
The correct environment variable is `$CODEBUILD_SRC_DIR_CommonStyles`.
This environment variable contains the absolute path to the directory containing the common stylesheet template.

Key Concept

AWS CodeBuild Multiple Source Inputs
Question 14Question →

A developer is setting up an AWS CodeBuild project to compile a simple web application. The developer needs to define the build commands and pull database connection configurations securely during the build execution.

Which TWO configurations are required to support this setup? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Place the buildspec.yml file at the root of the source directory to define the build phases.; Reference sensitive database configurations from AWS Systems Manager Parameter Store or AWS Secrets Manager in the env section of the buildspec file.

Answer

Placing the buildspec.yml file at the root of the source directory and referencing database configurations from Parameter Store or Secrets Manager in the env section of the buildspec file.
The correct options are placing the buildspec.yml file at the root of the source directory, which CodeBuild automatically locates, and referencing sensitive database configurations from Parameter Store or Secrets Manager in the env section of the buildspec to securely retrieve secrets.

Step-by-Step Solution

1
Determine the default buildspec file placement.
CodeBuild expects the buildspec.yml file at the root of the source repository unless a custom path is specified in the build project settings.
This allows the build runner to find and execute the build steps automatically.
2
Determine the secure configuration retrieval method.
Map database configurations dynamically inside the env parameter block of the buildspec using Parameter Store or Secrets Manager.
This avoids hardcoding sensitive information in the source code.

Key Concept

AWS CodeBuild buildspec configuration and secret retrieval
Question 15Question →

An organization requires a build environment in AWS CodeBuild to execute integration tests against an internal Amazon RDS DB instance situated in a private subnet. The build container must fetch external software packages from the public internet and retrieve a database password from AWS Secrets Manager. Currently, the build execution fails because it cannot access external repositories, and an authorization error occurs when fetching the credential from AWS Secrets Manager.

Which combination of steps should be taken to resolve these network and access issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet to allow internet connectivity.; Ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions and that its trust policy allows the service principal codebuild.amazonaws.com to assume the role.

Answer

To resolve the issues, configure the CodeBuild project to run within private subnets that have a route to a NAT gateway in a public subnet, and ensure that the CodeBuild IAM service role is granted secretsmanager:GetSecretValue permissions with a trust policy allowing codebuild.amazonaws.com to assume the role.
The correct configuration requires routing outbound traffic from CodeBuild's private VPC subnets to a NAT gateway so that the build container can reach the public internet to download external dependencies. Additionally, the CodeBuild IAM service role must have secretsmanager:GetSecretValue permission and a trust policy that allows codebuild.amazonaws.com to assume the role, enabling CodeBuild to authenticate and retrieve the database password.

Step-by-Step Solution

1
Analyze the networking failure
Identify that CodeBuild containers configured to run within a VPC do not receive public IP addresses. Therefore, placing them in public subnets or subnets without NAT gateways will prevent them from accessing the public internet to download dependencies.
To fix internet access inside a VPC, the CodeBuild project must be configured with private subnets that route outbound traffic through a NAT gateway.
2
Analyze the authorization failure for the database password
Identify that CodeBuild relies on an IAM service role to perform API operations like retrieving Secrets Manager secrets. The role requires the permission to get the secret, and the role's trust policy must trust codebuild.amazonaws.com.
Configuring the IAM service role with the correct trust relationship and the secretsmanager:GetSecretValue permission enables the build process to retrieve the secret.

Key Concept

AWS CodeBuild VPC networking and service role configuration
Estimated Time:2m 30s
Question 16Question →

A developer is configuring a continuous integration pipeline using AWS CodeBuild to compile a Node.js application, run unit tests, and push the resulting container image to an Amazon Elastic Container Registry (ECR) repository. The developer needs to configure the build process to meet the following requirements:

* The unit tests must run during the build process. If they fail, the build must stop immediately and mark the build run as failed.
* A cleanup script must execute to remove temporary files, regardless of whether the unit tests succeed or fail.
* The Docker image must only be built and pushed to Amazon ECR if all unit tests pass.

Which configuration should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure the buildspec file to run the unit tests in the build phase. Place the cleanup script in the post_build phase to run unconditionally. In the post_build phase, check the value of the CODEBUILD_BUILD_SUCCEEDING environment variable, and only build and push the Docker image if its value is 1.

Answer

Configure the buildspec file to run the unit tests in the build phase, place the cleanup script in the post_build phase to run unconditionally, and check the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase before building and pushing the Docker image.
The correct configuration uses the build phase to run the tests and the post_build phase to run the cleanup script unconditionally. By checking the value of the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase, the developer can conditionally build and push the Docker image only if all previous phases succeeded.

Step-by-Step Solution

1
Determine the appropriate lifecycle phases for execution and cleanup.
Unit tests are placed in the build phase so they fail the build immediately if they return a non-zero exit code. The cleanup script is placed in the post_build phase because it is guaranteed to execute even if the build phase fails.
CodeBuild executes the post_build phase regardless of the success or failure of previous phases, making it the correct place for cleanup tasks.
2
Implement conditional execution for the Docker build and push.
Check the value of the CODEBUILD_BUILD_SUCCEEDING environment variable in the post_build phase. If it is 1, proceed with the Docker build and ECR push commands; otherwise, skip them.
Using the built-in CODEBUILD_BUILD_SUCCEEDING variable prevents pushing an invalid or untested image if the unit tests in the build phase failed.
3
Ensure security and permission compliance.
Verify that the CodeBuild service role has a trust policy allowing codebuild.amazonaws.com to assume the role and permissions to write to ECR.
This guarantees that the CodeBuild service can assume the role and successfully push the Docker image to the registry.

Key Concept

AWS CodeBuild buildspec phases, environment variables, and execution behavior.
Question 17Question →

A developer is configuring an AWS CodeBuild project that runs inside a private subnet of a VPC to perform integration tests against an internal Amazon RDS database. The build process must retrieve a database password stored as a SecureString parameter in Systems Manager Parameter Store. The developer stores the build commands in a custom file named `build_config.yml` inside a subdirectory named `specs/` in the source repository.

During the initial run, the build fails with an error indicating that the build specification cannot be found.

Which combination of actions will resolve the buildspec finding error and allow the build to retrieve the parameter?

Show answer & explanation

Answer: Update the Buildspec path to `specs/build_config.yml` in the CodeBuild project settings. Additionally, ensure the VPC has either a NAT Gateway or a VPC interface endpoint for Systems Manager configured.

Answer

Update the Buildspec path to `specs/build_config.yml` in the CodeBuild project settings. Additionally, ensure the VPC has either a NAT Gateway or a VPC interface endpoint for Systems Manager configured.
The correct answer resolves the buildspec finding failure by specifying the custom path in the CodeBuild project configuration. It also addresses the connectivity issue by establishing a valid network path from the private VPC subnet to the public Systems Manager API.

Step-by-Step Solution

1
Address the buildspec location error.
By default, AWS CodeBuild looks for a file named `buildspec.yml` at the root of the source directory. Since the developer used a custom filename and path, the CodeBuild project's Buildspec setting must be updated to match this path.
This resolves the initial phase failure where CodeBuild cannot find the build specification.
2
Analyze VPC network requirements for accessing public AWS services.
CodeBuild containers running inside a private subnet of a VPC do not have direct internet access. To interact with public AWS services like Systems Manager Parameter Store, they need a route to the internet or private VPC endpoints.
Without this routing configuration, the build container will time out or fail when attempting to fetch parameters from Systems Manager.

Key Concept

AWS CodeBuild custom buildspec paths and VPC network access to AWS services
Estimated Time:2m 0s
Question 18Question →

A developer is setting up an AWS CodeBuild project that needs to pull dependency packages from a third-party private repository. The credentials for this repository must be rotated automatically every 30 days. The developer needs to configure the build environment to securely retrieve these credentials during the build process.

Which configuration should the developer implement to meet these requirements with the lowest operational overhead?

Show answer & explanation

Answer: Store the credentials in AWS Secrets Manager with automatic rotation. In the buildspec.yml file, reference the secret using the secrets-manager mapping under the env sequence.

Answer

Store the credentials in AWS Secrets Manager with automatic rotation. In the buildspec.yml file, reference the secret using the secrets-manager mapping under the env sequence.
Storing the credentials in AWS Secrets Manager is the correct approach because it natively supports automatic rotation of secrets. Referencing the secret in the env/secrets-manager section of the buildspec.yml file allows CodeBuild to securely retrieve the credentials at build time without exposing them in plaintext.

Step-by-Step Solution

1
Select the appropriate storage service for secrets requiring automatic rotation.
AWS Secrets Manager is chosen because it supports built-in automatic rotation using AWS Lambda, whereas Systems Manager Parameter Store does not.
Meeting the rotation requirement with the lowest operational overhead requires utilizing native service features.
2
Configure reference to the stored secret in the build definition.
Add the secret under the env/secrets-manager section of the buildspec.yml file.
This allows CodeBuild to fetch the credential dynamically at runtime, avoiding hardcoded values.
3
Ensure correct IAM permissions are attached to the CodeBuild service role.
Attach a policy with the secretsmanager:GetSecretValue permission to the CodeBuild execution role.
CodeBuild needs permission to retrieve the secret value from Secrets Manager during the build execution.

Key Concept

Secure credential retrieval and buildspec configuration in AWS CodeBuild
Estimated Time:2m 0s
Question 19Question →

An application development team is migrating their continuous integration process to AWS CodeBuild. The build environment needs to compile a Node.js application, install packages, and build a container image. To optimize build performance, the team wants to cache both the downloaded node modules and the intermediate Docker image layers using local caching on the build host.

Which combination of actions must the developer perform to configure the required caching? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the buildspec.yml file, add a cache block specifying the path to the node packages (e.g., node_modules/**/*).; In the CodeBuild project configuration, enable local cache and select both custom cache and Docker layer cache.

Answer

In the buildspec.yml file, add a cache block specifying the path to the node packages (e.g., node_modules/**/*), and in the CodeBuild project configuration, enable local cache and select both custom cache and Docker layer cache.
To cache custom paths such as dependency folders, the developer must specify the target directory in the buildspec.yml cache block. To use local host caching for both custom buildspec paths and intermediate Docker layers, the developer must also configure local cache in the project settings, explicitly enabling the custom cache and Docker layer cache types.

Step-by-Step Solution

1
Configure the buildspec file to define the custom folder to be cached.
A cache section is added to the buildspec.yml with the path 'node_modules/**/*'.
This instructs CodeBuild's caching mechanism which files to look for and package at the end of a build.
2
Configure the CodeBuild project's local caching behavior.
The project is configured to use local caching with 'Custom cache' and 'Docker layer cache' enabled.
This tells CodeBuild to store the custom path specified in buildspec.yml and intermediate Docker layers locally on the build host rather than uploading them to S3.

Key Concept

AWS CodeBuild Caching Configurations
Estimated Time:2m 0s
Question 20Question →

A company is migrating its build pipelines to AWS. A developer is setting up an AWS CodeBuild project that needs to run automated integration tests against a database. The build configuration requires retrieving a database password securely and using a custom build specification file named build-config.yml instead of the default buildspec.yml file.

Which combination of actions must the developer perform to successfully configure this build project? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Systems Manager Parameter Store as a SecureString parameter, and reference it under the parameter-store mapping in the env section of build-config.yml.; In the AWS CodeBuild project configuration, specify build-config.yml in the buildspec build settings.

Answer

Store the database password as a SecureString in Parameter Store and reference it in the parameter-store section of the custom buildspec file, and specify the custom buildspec filename in the CodeBuild project settings.
To successfully configure this project, the developer must override the default buildspec filename in the AWS CodeBuild project configuration by setting it to build-config.yml. Additionally, the developer must store the password as a SecureString in Systems Manager Parameter Store and reference it in the parameter-store mapping of the env section in the buildspec file. This allows CodeBuild to decrypt and expose the password as an environment variable during the build phases securely.

Step-by-Step Solution

1
Configure the CodeBuild project to use the custom buildspec file.
Specify the name build-config.yml in the buildspec settings of the project configuration.
By default, CodeBuild looks for a file named buildspec.yml at the root of the source directory. A custom filename must be explicitly defined.
2
Secure the database password using Parameter Store.
Store the database password as a SecureString parameter in Systems Manager Parameter Store.
SecureString ensures the parameter is encrypted at rest using a KMS key, which is standard practice for sensitive credentials like passwords.
3
Reference the parameter securely in the build specification.
Add the parameter-store mapping under the env section of the buildspec and map the environment variable to the Parameter Store parameter name.
This allows CodeBuild to retrieve the decrypted value dynamically during the build execution without hardcoding it in the source repository.

Key Concept

AWS CodeBuild project configuration including custom buildspec overrides and secure parameter retrieval via Systems Manager Parameter Store.
Page 1 / 2Next