Examkin

AWS CodeBuild

31 questions

All types31Multiple choice15Multiple select16
Question 21Question →

A developer is configuring a buildspec.yml file for an AWS CodeBuild project. The build environment requires access to a database connection password stored in AWS Secrets Manager and a non-sensitive configuration parameter stored in Systems Manager Parameter Store. The developer wants to retrieve these values securely and inject them as environment variables during the build phases without hardcoding them in the source code. Which approach should the developer take to retrieve these values?

Show answer & explanation

Answer: Define the non-sensitive configuration under the parameter-store mapping and the database password under the secrets-manager mapping inside the env section of the buildspec.yml file.

Answer

Define the non-sensitive configuration under the parameter-store mapping and the database password under the secrets-manager mapping inside the env section of the buildspec.yml file.
The correct option correctly uses CodeBuild's native capabilities to resolve environment variables. Defining the parameter in the parameter-store block and the secret in the secrets-manager block under the env section of buildspec.yml ensures that CodeBuild calls the appropriate AWS APIs at build initialization, retrieves the values securely, and makes them available to the build environment phases.

Step-by-Step Solution

1
Identify where the database connection password and non-sensitive configuration parameters are stored.
The password is in AWS Secrets Manager, and the parameter is in Systems Manager Parameter Store.
Understanding the source storage determines the corresponding configuration block to use in the buildspec.
2
Map the storage locations to the native environment variable structures supported by AWS CodeBuild.
AWS CodeBuild provides parameter-store and secrets-manager blocks under the env section of buildspec.yml to natively retrieve these values.
Using native blocks allows CodeBuild to automatically fetch the values at runtime using the build's IAM role, ensuring they are not hardcoded or exposed.
3
Specify the parameters under their correct respective blocks in the env section.
The configuration parameter goes under parameter-store and the database password goes under secrets-manager.
This guarantees that both services are accessed using the correct APIs and the fetched values are injected as environment variables.

Key Concept

AWS CodeBuild Environment Variable Resolution
Question 22Question →

A software development team configures an AWS CodeBuild project to run within a private subnet of a VPC to perform integration testing against an Amazon RDS DB instance. The integration tests connect to the database successfully, but the build project fails during the install phase when running commands to retrieve packages from a public software registry. Which of the following actions will resolve this build failure?

Show answer & explanation

Answer: Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route outbound internet traffic through the NAT gateway.

Answer

Configure a NAT gateway in a public subnet of the VPC, and update the private subnet's route table to route outbound internet traffic through the NAT gateway.
The correct answer is to configure a NAT gateway in a public subnet of the VPC and update the private subnet's route table. When AWS CodeBuild projects are configured to run inside a VPC, they do not have direct internet access. If the build needs to access both private resources (such as Amazon RDS) and public registries to pull dependencies, you must place the CodeBuild project in private subnets, configure a NAT gateway in a public subnet, and route outbound internet traffic (0.0.0.0/0) through that NAT gateway.

Step-by-Step Solution

1
Analyze the network path requirements.
The CodeBuild project successfully connects to Amazon RDS (inside the private VPC) but fails to reach the public internet (external package registry).
This indicates that internal VPC routing works, but there is no outbound path to the public internet.
2
Identify the standard VPC component needed for outbound-only internet access.
A NAT gateway is required to translate private IP addresses to a public IP address for internet communication.
Resources in a private VPC subnet require a NAT gateway located in a public subnet with a route to an Internet Gateway to access external endpoints.
3
Configure routing for the private subnet.
Update the private subnet route table to target the NAT gateway for destination '0.0.0.0/0'.
This ensures all internet-bound traffic from the CodeBuild container in the private subnet is forwarded through the NAT gateway.

Key Concept

AWS CodeBuild VPC connectivity and internet access requirements
Estimated Time:1m 30s
Question 23Question →

An engineer is setting up a build process in AWS CodeBuild for a repository where the build specification file is named buildspec.yml and is located inside a directory named config/ instead of the root directory. The build fails during the initial phase because the buildspec file cannot be found. How can the engineer configure CodeBuild to successfully locate and use this buildspec file?

Show answer & explanation

Answer: Update the buildspec path in the AWS CodeBuild project configuration to point to config/buildspec.yml.

Answer

Update the buildspec path in the AWS CodeBuild project configuration to point to config/buildspec.yml.
The correct action is to update the buildspec path in the AWS CodeBuild project settings to point to the actual subdirectory path. AWS CodeBuild allows developers to override the default root location by specifying a custom file path relative to the root of the repository.

Step-by-Step Solution

Identify the default behavior of AWS CodeBuild regarding the buildspec file.
CodeBuild expects the buildspec.yml file to be located at the root of the source directory by default.
To understand why the build is failing when the file is in the config/ directory.
Determine how to override the default buildspec path in CodeBuild.
The project configuration allows defining a custom path relative to the root directory, such as config/buildspec.yml.
To tell CodeBuild where to look for the configuration file during the build initialization phase.
Update the CodeBuild project settings using the AWS Console, AWS CLI, or AWS CloudFormation.
The build specification is resolved successfully and the build starts.
To apply the configuration changes and fix the failing build.

Key Concept

Custom Buildspec File Paths
Question 24Question →

A developer is configuring an AWS CodeBuild project to build a Docker image and push it to an Amazon Elastic Container Registry (ECR) repository. The CodeBuild project is configured to run inside a private VPC subnet to access internal databases. During the build execution, CodeBuild fails to pull the public base image from Docker Hub and fails to authenticate with the Amazon ECR repository. Which TWO actions should the developer take to resolve these issues?

Select all that apply

Show answer & explanation

Answer: Configure a NAT Gateway in a public subnet of the VPC, and update the route table of the CodeBuild private subnet to route outbound traffic through the NAT Gateway.; Add the ecr:GetAuthorizationToken permission and repository permissions (such as ecr:BatchCheckLayerAvailability and ecr:PutImage) to the IAM service role associated with the CodeBuild project.

Answer

The developer should configure a NAT Gateway to allow internet access for CodeBuild's private subnet, and attach the required ECR permissions to the CodeBuild service role.
Routing outbound traffic through a NAT Gateway enables the CodeBuild container inside the private subnet to connect to the public Docker Hub registry. Additionally, attaching ECR permissions to the service role allows the build container to authenticate and push the compiled Docker image to Amazon ECR.

Step-by-Step Solution

1
Analyze the network route for pulling external dependencies.
CodeBuild requires internet access to pull base images from public Docker Hub. Since CodeBuild is running in a private VPC subnet, a NAT Gateway must be configured in a public subnet to forward this outbound traffic.
Resolves the connection failure when attempting to pull the public base image.
2
Analyze IAM role permissions for ECR authentication and upload.
The CodeBuild project's service role needs permission to fetch an authorization token from ECR (ecr:GetAuthorizationToken) and perform repository write actions.
Resolves the authentication and push authorization failures when interacting with Amazon ECR.

Key Concept

AWS CodeBuild VPC routing and ECR IAM permissions
Question 25Question →

A developer is configuring a new AWS CodeBuild project to build and package a serverless application. When attempting to start a build, the execution fails immediately with the error message: "Failed to assume the service role." The developer confirms that the associated IAM service role has the correct managed policies for accessing Amazon S3, Amazon CloudWatch Logs, and VPC resources. What should the developer modify to resolve this issue and allow the build to initiate?

Show answer & explanation

Answer: The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.

Answer

The trust relationship of the IAM service role, ensuring that the codebuild.amazonaws.com service principal is allowed to perform the sts:AssumeRole action.
The correct option is the one specifying the trust relationship of the IAM service role. For AWS CodeBuild to execute a build, it must assume the specified IAM service role. This trust relationship must be defined in the role's trust policy, permitting the 'codebuild.amazonaws.com' service principal to call 'sts:AssumeRole'.

Step-by-Step Solution

1
Analyze the error message "Failed to assume the service role."
Identify that the issue is an authorization failure preventing CodeBuild from assuming the assigned IAM role at build start.
This isolates the issue to the trust boundary between the AWS CodeBuild service and the IAM service role.
2
Differentiate between IAM permissions policies and IAM trust policies.
Determine that while permissions policies govern what the role can do after it is assumed, the trust policy (trust relationship) governs which entities are permitted to assume the role.
This explains why verifying the attached managed policies did not solve the startup failure.
3
Configure the trust relationship to trust CodeBuild.
Add codebuild.amazonaws.com as a trusted service principal with the sts:AssumeRole action.
This allows CodeBuild to successfully assume the role and execute the container environment.

Key Concept

AWS CodeBuild Service Role Trust Policy
Question 26Question →

A developer is setting up an AWS CodeBuild project for a microservice located in a subdirectory (`services/order-service`) of a monorepo. The build process needs to run tests that require a database password stored in AWS Secrets Manager, and it must use a custom build specification file located at `services/order-service/buildspec.yml`. During the initial build run, the build fails immediately because the build specification file cannot be found, and the developer realizes that the application also lacks permission to fetch the database password.

Which combination of actions must the developer take to resolve these issues? (Select two.)

Select all that apply

Show answer & explanation

Answer: Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml.; Add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.

Answer

Configure the buildspec file path in the CodeBuild project settings to point to services/order-service/buildspec.yml, and add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project.
To fix the buildspec resolution issue, the developer must update the CodeBuild project settings to specify the custom path services/order-service/buildspec.yml, since CodeBuild expects buildspec.yml in the repository root by default. To resolve the permission issue, the developer must add the secretsmanager:GetSecretValue permission to the IAM service role associated with the CodeBuild project so that it is authorized to retrieve the database credentials.

Step-by-Step Solution

1
Configure the CodeBuild project settings with the custom buildspec location.
CodeBuild searches for the buildspec at services/order-service/buildspec.yml instead of the default root path, successfully finding and executing it.
By default, CodeBuild expects the buildspec file to be named buildspec.yml and located in the root of the repository source directory. Any other configuration must be specified in the project settings.
2
Update the IAM service role permissions policy for the CodeBuild project.
The project gains permission to fetch the secret from Secrets Manager.
CodeBuild assumes a service role during execution. This role must have an identity-based policy allowing secretsmanager:GetSecretValue in order to read the credentials.

Key Concept

AWS CodeBuild buildspec configuration and IAM service role permissions.
Question 27Question →

A developer is configuring a build project in AWS CodeBuild to package an application. The build process requires retrieving a non-sensitive database port number that rarely changes, and a database password that must be automatically rotated every 30 days. To optimize for cost, operational efficiency, and security, which configuration should the developer implement?

Show answer & explanation

Answer: Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.

Answer

Store the database port in AWS Systems Manager Parameter Store and the database password in AWS Secrets Manager, and retrieve them using the parameter-store and secrets-manager blocks under the env section of the buildspec.yml file.
Storing the port in Parameter Store is cost-effective because standard parameters are free. Storing the password in Secrets Manager meets the security requirement for automatic rotation. Referencing them in the parameter-store and secrets-manager blocks of the env section in the root buildspec.yml file allows CodeBuild to automatically fetch the values and inject them as environment variables during the build execution.

Step-by-Step Solution

1
Identify the security and operational requirements of the two variables.
The database port is non-sensitive and static, while the database password is sensitive and requires automatic rotation every 30 days.
This classification determines the most cost-effective and secure AWS service to store each parameter.
2
Select the appropriate storage service for each parameter type.
AWS Systems Manager Parameter Store is chosen for the database port to avoid costs. AWS Secrets Manager is chosen for the database password to support automatic rotation.
Parameter Store does not natively support rotation of secrets, while Secrets Manager is expensive for non-sensitive parameters.
3
Configure the retrieval mechanism in the build specification.
Reference the variables under their respective blocks (parameter-store and secrets-manager) in the env section of the root buildspec.yml file.
AWS CodeBuild natively supports retrieving values from both services during the build lifecycle when configured in the buildspec.

Key Concept

Retrieving configuration data and secrets in AWS CodeBuild using AWS Systems Manager Parameter Store and AWS Secrets Manager
Estimated Time:1m 30s
Question 28Question →

A developer is configuring an AWS CodeBuild project that runs as a stage in an AWS CodePipeline. During the build execution, a script generates a dynamic version identifier based on the current git commit hash. The developer needs to pass this dynamically generated version identifier directly to a subsequent deployment stage in the pipeline without creating external dependencies. Which configuration in the `buildspec.yml` file will achieve this?

Show answer & explanation

Answer: Define the variable name under the `exported-variables` sequence in the `env` block.

Answer

Define the variable name under the `exported-variables` sequence in the `env` block.
Defining the variable name under the `exported-variables` sequence in the `env` block allows CodeBuild to export the value of environment variables that are dynamically set during the build execution. AWS CodePipeline captures these exported variables and makes them available to downstream pipeline actions as variables.

Step-by-Step Solution

1
Add the desired environment variable name to the `exported-variables` sequence under the `env` block in `buildspec.yml`.
CodeBuild is configured to monitor and capture this specific environment variable's value at the end of the build execution.
This registers the variable name so CodeBuild knows to export it.
2
Assign the dynamic commit-based value to the environment variable inside one of the build commands, such as using `export MY_VERSION=$(git rev-parse --short HEAD)`.
The variable is populated with the dynamically generated value during the build execution.
This updates the environment variable's value dynamically during runtime.
3
Reference the exported variable in downstream CodePipeline actions using the namespace syntax.
The subsequent stages in AWS CodePipeline can access the version identifier natively.
This completes the transfer of the dynamic variable across the pipeline without external API calls or storage.

Key Concept

AWS CodeBuild Exported Variables
Question 29Question →

A developer is configuring an AWS CodeBuild project to build a containerized application. The build process must retrieve a database credential that undergoes automatic rotation every 3030 days. In addition, the source code repository holds a custom build specification file at the path `build-configs/custom-buildspec.yml` instead of the root directory.

Which two configurations must the developer perform to ensure the build project executes successfully?

Select all that apply

Show answer & explanation

Answer: Configure the CodeBuild project settings by specifying `build-configs/custom-buildspec.yml` in the buildspec configuration path.; Store the database credential in AWS Secrets Manager and reference it in the `secrets-manager` section under the `env` sequence in the buildspec file.

Answer

The developer must configure the CodeBuild project settings to point to the custom buildspec path, and store the database credential in AWS Secrets Manager while referencing it in the buildspec's env section.
To successfully execute this build project, the developer must specify the custom buildspec location (`build-configs/custom-buildspec.yml`) in the CodeBuild project configuration because CodeBuild defaults to looking for a file named `buildspec.yml` in the root directory. Additionally, because the database credential requires automatic rotation, it must be stored in AWS Secrets Manager (which supports rotation) and retrieved in the buildspec file using the `secrets-manager` parameter within the `env` section.

Step-by-Step Solution

1
Determine the correct storage and retrieval mechanism for a rotated database credential.
Choose AWS Secrets Manager over Systems Manager Parameter Store.
The requirement specifies that the credential undergoes automatic rotation, which is natively supported by AWS Secrets Manager.
2
Determine the configuration needed to handle the custom buildspec file location.
Explicitly set the buildspec path in the CodeBuild project settings to `build-configs/custom-buildspec.yml`.
By default, CodeBuild looks for a file named `buildspec.yml` at the root of the repository. Any custom path or filename must be declared in the project settings.

Key Concept

Configuring custom buildspec paths in AWS CodeBuild and integrating AWS Secrets Manager for secrets requiring automatic rotation.
Estimated Time:1m 30s
Question 30Question →

An organization is setting up a continuous integration pipeline. The build phase is executed by AWS CodeBuild using a custom IAM service role. However, during the initial run, the build fails immediately before executing any build phases, throwing an error that CodeBuild is not authorized to assume the specified service role. Which of the following actions will resolve this issue?

Show answer & explanation

Answer: Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.

Answer

Modify the trust policy of the IAM service role to allow the codebuild.amazonaws.com service principal to assume the role.
The correct answer is to modify the trust policy of the IAM service role. AWS CodeBuild requires a service role to perform actions on your behalf. For CodeBuild to assume this role, the role's trust policy must explicitly allow the 'codebuild.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. Without this trust relationship, CodeBuild cannot run the build project and fails immediately during initialization.

Step-by-Step Solution

1
Identify the service principal for AWS CodeBuild.
The service principal is codebuild.amazonaws.com.
AWS services require trust relationships defined by their specific service principal to assume IAM roles.
2
Locate the trust policy of the CodeBuild service role in the IAM console.
The trust policy is found under the 'Trust relationships' tab of the role.
The trust policy determines which entities are trusted to assume the role.
3
Update the trust policy document to include the service principal with sts:AssumeRole permission.
CodeBuild is now authorized to assume the role, and the build starts successfully.
Allowing the service principal in the trust policy resolves the authorization failure during CodeBuild initialization.

Key Concept

AWS CodeBuild service role trust policy configuration
Question 31Question →

A developer is configuring an AWS CodeBuild project to compile and package a Java application. The buildspec.yml file is placed in the root of the source repository and contains a valid artifacts section listing the target JAR file. The build execution completes with a status of SUCCEEDED, but no artifacts are uploaded to the destination Amazon S3 bucket. Which of the following is the most likely cause of this issue?

Show answer & explanation

Answer: The artifact type in the CodeBuild project configuration is set to 'No artifacts'.

Answer

The artifact type in the CodeBuild project configuration is set to 'No artifacts'.
The correct answer is correct because AWS CodeBuild requires the artifact output configuration to be enabled in the project configuration (e.g., set to Amazon S3) for it to upload the files specified in the buildspec.yml. When set to 'No artifacts', CodeBuild executes the build successfully but performs no upload actions.

Step-by-Step Solution

1
Analyze the build status and output.
The build status is SUCCEEDED, which means CodeBuild successfully executed all build phases defined in the buildspec.yml without encountering fatal errors.
Understanding the status helps rule out configuration errors that would cause execution failures, such as missing buildspec files or parameter retrieval errors.
2
Evaluate the artifact upload behavior in AWS CodeBuild.
CodeBuild relies on both the buildspec.yml file (which defines which files to upload) and the project configuration (which defines where to upload them).
If the project configuration is set to 'No artifacts', CodeBuild runs the build but does not look for or upload any output files.

Key Concept

AWS CodeBuild project configuration settings for artifacts override buildspec declarations.
PreviousPage 2 / 2
AWS CodeBuild Practice Questions — AWS Certified Developer - Associate — Page 2 | Examkin