A developer is configuring a build in AWS CodeBuild that must retrieve an encrypted database password from the Systems Manager Parameter Store. The developer places a custom build specification file named build-config.yml inside a subdirectory named config in the source repository. When the build is triggered, CodeBuild fails with an error indicating that the buildspec file cannot be found. Additionally, once the buildspec is resolved, the build needs to be able to fetch and decrypt the password from Parameter Store.
Which TWO actions should the developer take to resolve these issues and ensure the build completes successfully?
- Update the CodeBuild project settings to specify the buildspec path as config/build-config.yml.Cevap
- Add the ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.Cevap
- CRename the build specification file to buildspec.yml and keep it in the config directory without modifying the project settings.
- DModify the trust policy of the CodeBuild IAM role to allow the Systems Manager service (ssm.amazonaws.com) to assume the role.
- EReference the SSM parameter using a Secrets Manager ARN inside the secrets section of the buildspec file.
Cevap
To resolve the issues, the developer must configure the custom buildspec path as config/build-config.yml in the CodeBuild project settings, and add both ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.
Specifying the custom buildspec path config/build-config.yml in the project settings tells CodeBuild where to locate the configuration file. Granting ssm:GetParameters and kms:Decrypt to the CodeBuild service role provides the necessary permissions to read and decrypt the secure parameter.
Adım Adım Çözüm
Anahtar Kavram
AWS CodeBuild buildspec configuration and IAM permissions for Systems Manager integration.