Soru

Zorluk: ZorAWS CodeBuild

A developer is configuring a build in AWS CodeBuild that must retrieve an encrypted database password from the Systems Manager Parameter Store. The developer places a custom build specification file named build-config.yml inside a subdirectory named config in the source repository. When the build is triggered, CodeBuild fails with an error indicating that the buildspec file cannot be found. Additionally, once the buildspec is resolved, the build needs to be able to fetch and decrypt the password from Parameter Store.

Which TWO actions should the developer take to resolve these issues and ensure the build completes successfully?

  1. Update the CodeBuild project settings to specify the buildspec path as config/build-config.yml.Cevap
  2. Add the ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.Cevap
  3. C
    Rename the build specification file to buildspec.yml and keep it in the config directory without modifying the project settings.
  4. D
    Modify the trust policy of the CodeBuild IAM role to allow the Systems Manager service (ssm.amazonaws.com) to assume the role.
  5. E
    Reference the SSM parameter using a Secrets Manager ARN inside the secrets section of the buildspec file.

Cevap

To resolve the issues, the developer must configure the custom buildspec path as config/build-config.yml in the CodeBuild project settings, and add both ssm:GetParameters and kms:Decrypt permissions to the CodeBuild service IAM role.
Specifying the custom buildspec path config/build-config.yml in the project settings tells CodeBuild where to locate the configuration file. Granting ssm:GetParameters and kms:Decrypt to the CodeBuild service role provides the necessary permissions to read and decrypt the secure parameter.

Adım Adım Çözüm

1
Address the missing buildspec file issue.
Configured the project to look at config/build-config.yml instead of the default root path.
CodeBuild defaults to looking for buildspec.yml at the root directory. Subdirectories require explicit path mapping.
2
Configure Systems Manager Parameter Store permissions.
Added ssm:GetParameters to the CodeBuild service role.
Allows CodeBuild to retrieve the parameter value from Systems Manager Parameter Store.
3
Configure AWS Key Management Service (KMS) permissions.
Added kms:Decrypt to the CodeBuild service role.
Since the parameter is stored as a SecureString, CodeBuild needs decrypt permissions for the KMS key that encrypts it.

Anahtar Kavram

AWS CodeBuild buildspec configuration and IAM permissions for Systems Manager integration.
Bu soruyu puanla