DOP-C02 Question 267
Single answerYour organization has a CI/CD pipeline implemented in AWS CodePipeline. A recent security audit recommended that all artifacts generated during the build stage should be encrypted at rest using a custom AWS Key Management Service (KMS) key. What is the BEST way to achieve this in CodePipeline?
- A
Update the artifact store in CodePipeline to use an S3 bucket encrypted with the custom KMS key.
- B
Enable server-side encryption on the S3 bucket used by the artifact store and specify the custom KMS key in the bucket's settings.
- C
Modify the buildspec file in the CodeBuild stage to specify encryption using the custom KMS key.
- D
Create a new CodePipeline and configure it to use a new artifact store with the custom KMS key.
Show answer and explanation
Correct answer: A
Explanation
In AWS CodePipeline, the artifact store is the location where artifacts are stored during the pipeline execution. To meet the security requirement of encrypting artifacts at rest with a custom KMS key, you should configure the artifact store to use an S3 bucket that is encrypted with the specified custom KMS key. This approach aligns with best practices for securing pipeline artifacts.
- A. Correct.
Correct. Updating the artifact store to use an S3 bucket encrypted with the custom KMS key ensures that all artifacts generated during the pipeline execution are encrypted at rest using the specified key.
- B. Incorrect.
Incorrect. While enabling server-side encryption on the S3 bucket is related to encryption, CodePipeline requires you to configure the artifact store directly, rather than relying solely on the S3 bucket's settings.
- C. Incorrect.
Incorrect. The buildspec file in the CodeBuild stage controls the build process, not the encryption of artifacts in the artifact store.
- D. Incorrect.
Incorrect. Creating a new CodePipeline is unnecessary. Updating the existing artifact store to use the custom KMS key is sufficient to meet the requirement.