DOP-C02 Question 240
Single answerYour team manages a CI/CD pipeline using AWS CodePipeline integrated with AWS CodeBuild for building and testing your application. Recently, builds have started failing intermittently due to insufficient permissions to access an Amazon S3 bucket storing build artifacts. As a DevOps Engineer, you need to implement a solution to ensure that the CodeBuild service has the required permissions to access the S3 bucket while adhering to the principle of least privilege. What should you do?
- A
Attach a policy to the IAM role used by CodeBuild granting full access to all S3 buckets.
- B
Attach a policy to the IAM role used by CodeBuild granting read and write access to the specific S3 bucket.
- C
Configure the S3 bucket to allow public access, ensuring CodeBuild can access it.
- D
Create a VPC endpoint for S3 and associate it with CodeBuild to grant access to the bucket.
- E
Use an S3 bucket policy that explicitly grants access to the CodeBuild service's IAM role.
Show answer and explanation
Correct answer: B
Explanation
The issue arises because the IAM role used by CodeBuild does not have sufficient permissions to access the specific S3 bucket. To resolve this, you should attach a policy to the CodeBuild IAM role that grants read and write permissions to the specific bucket. This solution adheres to the principle of least privilege, ensuring that access is restricted to only what is necessary. Configuring public access to the bucket or granting overly broad permissions would introduce significant security risks, while using a VPC endpoint does not address the immediate permissions issue.
- A. Incorrect.
This option violates the principle of least privilege by granting full access to all S3 buckets, which is unnecessary and a security risk.
- B. Correct.
This is the correct solution as it adheres to the principle of least privilege by only granting the required permissions (read and write) to the specific S3 bucket.
- C. Incorrect.
Configuring the S3 bucket for public access is a major security risk and does not align with best practices for securing resources in AWS.
- D. Incorrect.
While a VPC endpoint for S3 can improve access performance and security, it does not address the issue of permissions, which is the root cause of the problem.
- E. Incorrect.
An S3 bucket policy could work, but permissions should ideally be managed at the IAM role level to keep access control centralized and more manageable.