A developer is configuring a continuous delivery pipeline in AWS CodePipeline. The pipeline has a deploy stage that deploys a serverless API, followed by an integration test stage that runs an AWS Lambda function. The Lambda function must retrieve a database password that requires automatic rotation every 30 days. Additionally, the Lambda function needs permissions to execute and log to Amazon CloudWatch.
Which two configurations should the developer implement to satisfy these requirements? (Select TWO.)
- Store the database password in AWS Secrets Manager and configure automatic rotation.Cevap
- BStore the database password in AWS Systems Manager Parameter Store as a SecureString parameter and enable automatic rotation.
- Configure the Lambda function's IAM execution role with a trust policy that allows the lambda.amazonaws.com service principal to assume the role.Cevap
- DConfigure the Lambda function's IAM execution role with a trust policy that allows the codepipeline.amazonaws.com service principal to assume the role.
- EPass the database password to the Lambda function as a plaintext environment variable in the CodePipeline deploy action configuration.
Cevap
Store the database password in AWS Secrets Manager and configure automatic rotation, and configure the Lambda function's IAM execution role with a trust policy that allows the lambda.amazonaws.com service principal to assume the role.
Storing the password in AWS Secrets Manager satisfies the requirement for automatic 30-day rotation, as Secrets Manager natively handles automatic rotation via integrated Lambda templates. Additionally, configuring the Lambda function's execution role with a trust policy that allows lambda.amazonaws.com ensures the Lambda service can assume the role at runtime to perform its actions and write logs to CloudWatch.
Adım Adım Çözüm
Anahtar Kavram
AWS CodePipeline integration with AWS Lambda and secure credential management using AWS Secrets Manager.