AWS Certified Devops Engineer Professional · Free Practice Question Medium
Question 9
An application is being deployed using an AWS CodePipeline pipeline. The pipeline includes an AWS CodeBuild stage which downloads source code from AWS CodeCommit, pulls data from an S3 bucket, and builds and tests the application before deployment.
A DevOps engineer has discovered that the S3 data is not being successfully downloaded due to a permissions issue.
How can the permissions be assigned to CodeBuild in the MOST secure manner?
-
A
Configure an IAM access key and a secret access key in the application code and use the AWS CLI to download the data.
-
B
Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the buildspec to use cURL to pass the token and download the data.
-
C
Use an aws:Referer condition key in the CodeBuild project settings. Update the buildspec to use the AWS CLI to download the data.
-
D
Modify the service role for the CodeBuild project to include permissions for S3. Use the AWS CLI to download the data.
Reveal correct answer
Correct answer: D
Explanation
The most likely issue is that the service role used by AWS CodeBuild does not have the correct permissions to download the data securely from the Amazon S3 bucket. CodeBuild uses the service role for all operations that are performed on your behalf. Therefore, the role must have the permissions needed during the build stage.
In this case, simply adding the correct permissions statements to the policy attached to the service role should resolve the permission issue. The data can then be downloaded from S3 using the AWS CLI by specifying commands in the buildspec document.
CORRECT: "Modify the service role for the CodeBuild project to include permissions for S3. Use the AWS CLI to download the data" is the correct answer (as explained above.)
INCORRECT: "Configure an IAM access key and a secret access key in the application code and use the AWS CLI to download the data" is incorrect.
This is an insecure method of using credentials and should be avoided. It would also not provide the permissions needed by CodeBuild as the service gets those permissions from the service role.
INCORRECT: "Use an aws:Referer condition key in the CodeBuild project settings. Update the buildspec to use the AWS CLI to download the data" is incorrect.
The condition key referenced is used in policies to restrict access to specific HTTP referers. This is not useful here as it does not provide any permissions to CodeBuild.
INCORRECT: "Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the buildspec to use cURL to pass the token and download the data" is incorrect.
You cannot configure different authentication options on S3 as it is a managed service. You can only limit who can access the bucket and objects and under what conditions.
References:
https://docs.aws.amazon.com/codebuild/latest/userguide/setting-up.html#setting-up-service-role
Save time with our AWS cheat sheets:
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
