Examkin

Soru

Zorluk: OrtaAWS CodePipeline

A developer is setting up an AWS CodePipeline to deploy a serverless application. The pipeline includes a deploy stage that triggers a custom AWS Lambda action to run database schema migrations. The Lambda action requires access to database credentials, and the pipeline itself must have permission to invoke the Lambda function. Which two of the following configuration steps should the developer perform to meet these requirements securely? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and retrieve them programmatically within the Lambda function.Cevap
  2. Configure the trust policy of the IAM role associated with AWS CodePipeline to allow the codepipeline.amazonaws.com service principal to assume the role.Cevap
  3. C
    Store the database credentials as a standard String parameter in Systems Manager Parameter Store.
  4. D
    Attach an IAM policy to the CodePipeline service role that contains a trust relationship statement allowing the CodePipeline service principal to perform the sts:AssumeRole action.
  5. E
    Configure a resource-based policy on the database credentials in AWS Secrets Manager that trusts the CodePipeline service principal directly to retrieve the secret.

Cevap

The correct steps are to store the database credentials in AWS Secrets Manager and to configure the trust policy of the IAM role associated with AWS CodePipeline to allow the CodePipeline service principal to assume the role.
Storing database credentials in AWS Secrets Manager is the correct practice because Secrets Manager encrypts the credentials at rest and supports automatic rotation. Additionally, the AWS CodePipeline service role requires a trust policy (also known as an assume role policy) that allows the CodePipeline service principal to assume the role in order to perform pipeline actions.

Adım Adım Çözüm

1
Identify the correct storage service for database credentials.
AWS Secrets Manager is chosen for credential storage.
Secrets Manager encrypts credentials at rest and supports automatic rotation, meeting security requirements.
2
Configure permissions for CodePipeline execution.
The trust policy of the CodePipeline service role is configured to allow the codepipeline.amazonaws.com service principal to assume the role.
This trust relationship is necessary for CodePipeline to assume the role and execute the deployment steps.

Anahtar Kavram

AWS CodePipeline Custom Actions and IAM Roles
Bu soruyu puanla

Konular

AWS CodePipeline

Bu konudan daha fazla soru