DOP-C02 Question 311
Single answerYour company is using a CI/CD pipeline with AWS CodePipeline to deploy an application to an Amazon ECS cluster. The pipeline frequently fails during the deploy stage due to dependency issues in the container image. The development team has requested that you implement a solution to ensure the container images used in the pipeline are tested for dependency issues before deployment. Which approach would best meet the requirement?
- A
Integrate a step in the pipeline to use Amazon Inspector to scan the container images for vulnerabilities before deployment.
- B
Implement a custom Lambda function in the pipeline to validate the container images against a dependency whitelist.
- C
Use AWS CodeBuild to build and test the container images for dependency issues before they are pushed to Amazon ECR.
- D
Enable image scanning in Amazon ECR and configure the pipeline to fail if any vulnerabilities are found.
Show answer and explanation
Correct answer: C
Explanation
Using AWS CodeBuild to build and test container images is the best approach because it integrates seamlessly with AWS CodePipeline and allows you to identify dependency issues during the build phase. This ensures that only valid container images are pushed to Amazon ECR, reducing deployment failures caused by dependency problems.
- A. Incorrect.
Amazon Inspector is used to identify security vulnerabilities in EC2 instances and container images running on ECS. However, it does not natively integrate into a pipeline to test for dependency issues during the build process.
- B. Incorrect.
Using a custom Lambda function might be a viable solution, but it increases maintenance complexity. AWS services like CodeBuild are better suited for building and testing container images.
- C. Correct.
AWS CodeBuild is specifically designed to build and test applications, including container images. By integrating CodeBuild into the pipeline, you can test for dependency issues before pushing images to ECR, ensuring a smooth deployment.
- D. Incorrect.
While enabling image scanning in Amazon ECR can detect vulnerabilities, it is a post-build process and does not directly test for dependency issues during the CI/CD pipeline execution.