DOP-C02 Question 377
Single answerYour company is scaling its CI/CD pipeline and requires a solution to ensure secure access to sensitive environment variables, such as database credentials or API keys, during the build and deployment stages. As the DevOps Engineer, you need to implement a solution that integrates with AWS CodePipeline and AWS CodeBuild while ensuring that these sensitive values are not exposed in logs or build artifacts. Which solution would best meet these requirements?
- A
Store sensitive values in AWS Secrets Manager and reference them in AWS CodeBuild using environment variables.
- B
Include sensitive values directly in the buildspec.yml file for AWS CodeBuild.
- C
Encrypt sensitive values with AWS KMS and include the encrypted values in the buildspec.yml file.
- D
Store sensitive values in Amazon S3 with public-read access and reference them in the buildspec.yml file.
Show answer and explanation
Correct answer: A
Explanation
The best practice for securely managing sensitive values in a CI/CD pipeline is to use a service like AWS Secrets Manager. Secrets Manager integrates with AWS CodeBuild and allows you to securely inject secrets as environment variables. This ensures that sensitive values are not exposed in logs, build artifacts, or configuration files, meeting both security and operational requirements.
- A. Correct.
AWS Secrets Manager is designed to securely store and manage sensitive values, such as database credentials and API keys. It integrates with AWS services like CodeBuild, allowing you to reference secrets securely in environment variables without exposing them in logs or build artifacts.
- B. Incorrect.
Including sensitive values directly in the buildspec.yml file is insecure because it exposes them in plain text, which could lead to security vulnerabilities.
- C. Incorrect.
While encrypting sensitive values with AWS KMS is a valid approach, including encrypted values in the buildspec.yml file still exposes the values and requires additional decryption logic, increasing complexity and risk.
- D. Incorrect.
Storing sensitive values in Amazon S3 with public-read access is highly insecure as it exposes sensitive information to anyone, violating best practices for securing secrets.