DOP-C02 Question 166
Single answerYour company is using AWS CodePipeline for continuous delivery. During the deployment phase, you need to ensure that your application passes specific security checks and compliance requirements before proceeding to the next stage. The security team already has a Dockerized static analysis tool hosted on Amazon Elastic Container Registry (ECR) that performs these checks. How can you integrate this tool into your pipeline with minimal operational overhead?
- A
Use an AWS Lambda function to pull the Docker image from ECR, run the tool, and output the results to Amazon S3 for the pipeline to analyze.
- B
Add an AWS CodeBuild action in the pipeline to run the Docker image from ECR and handle the security checks.
- C
Run the Dockerized tool manually outside of the pipeline and input the results into the pipeline as artifacts.
- D
Use an Amazon ECS service to run the Docker image and integrate it with the pipeline through custom scripts.
Show answer and explanation
Correct answer: B
Explanation
AWS CodeBuild is designed to integrate seamlessly with AWS CodePipeline and supports running Docker containers from Amazon ECR. By using a CodeBuild action, the pipeline can execute the security checks with minimal setup and operational overhead, ensuring automation and compliance with DevOps principles.
- A. Incorrect.
This option would involve additional complexity in setting up Lambda to manage Docker containers, which is not natively supported. AWS CodeBuild is better suited for this use case.
- B. Correct.
AWS CodeBuild natively supports running Docker images from ECR, making it the most straightforward and operationally efficient solution for integrating the security tool into the pipeline.
- C. Incorrect.
Running the tool manually outside the pipeline introduces unnecessary manual effort and is not aligned with the principles of continuous delivery and automation.
- D. Incorrect.
While Amazon ECS can run Docker images, integrating it with CodePipeline through custom scripts would require more operational overhead compared to using AWS CodeBuild.