DOP-C02 Question 123
Single answerA company is using AWS CodePipeline to automate the deployment of their applications. A recent security audit highlighted that sensitive information such as database credentials and API keys were being exposed in plain text during the build process. As a DevOps Engineer, you are tasked with addressing this issue while ensuring minimal disruption to the pipeline. Which approach should you take to securely manage sensitive data in the build process?
- A
Store sensitive information as plaintext environment variables in the buildspec.yml file.
- B
Use AWS Secrets Manager and reference the secrets in the buildspec.yml file using parameter store integration.
- C
Encrypt sensitive information using AWS KMS and store the encrypted values in the buildspec.yml file.
- D
Use CodeBuild environment variables encrypted with AWS KMS and retrieve them using CodeBuild's built-in functionality.
Show answer and explanation
Correct answer: D
Explanation
To securely manage sensitive information in CodePipeline and CodeBuild, it is recommended to use environment variables encrypted with AWS KMS. These values can be securely accessed during the build process without exposing sensitive information in plaintext or requiring manual decryption steps. This approach ensures compliance with security best practices and addresses the audit findings effectively.
- A. Incorrect.
Storing sensitive information as plaintext in the buildspec.yml file is highly insecure and violates security best practices. This would not resolve the issue identified in the audit.
- B. Incorrect.
Although AWS Secrets Manager can be used to securely store sensitive information, it cannot be directly referenced in the buildspec.yml file without additional steps. This approach would require custom implementation for retrieval and integration.
- C. Incorrect.
Encrypting sensitive data with AWS KMS and storing encrypted values in the buildspec.yml file requires manual decryption during the build process. It adds complexity and is not the recommended approach for CodePipeline and CodeBuild.
- D. Correct.
Using CodeBuild environment variables encrypted with AWS KMS allows sensitive data to be securely managed and accessed during the build process. This is the recommended and most secure approach for this scenario.