DOP-C02 Question 45
Select 3Your DevOps team is managing a CI/CD pipeline that builds and deploys microservices to Amazon ECS. The build artifacts, such as Docker images, are stored in Amazon ECR. The security team has raised concerns about ensuring that the artifacts are securely managed and accessed only by authorized systems. What steps should you take to meet these requirements?
- A
Enable encryption for the images stored in Amazon ECR using AWS KMS.
- B
Configure an Amazon S3 bucket to store the Docker images and set up bucket policies to restrict access.
- C
Use Amazon ECR repository policies to grant access only to specific IAM roles and ECS tasks.
- D
Implement image scanning in Amazon ECR to detect vulnerabilities in the stored Docker images.
- E
Store the Docker images in an EC2 instance with strict security group rules.
Show answer and explanation
Correct answers: A, C, D
Explanation
To ensure secure management and access to Docker images stored in Amazon ECR, you should enable encryption using AWS KMS, restrict access using ECR repository policies, and implement image scanning to detect vulnerabilities. These steps align with best practices for artifact security and management in a CI/CD pipeline. Storing Docker images outside of Amazon ECR or using inappropriate storage solutions like Amazon S3 or EC2 instances is not recommended.
- A. Correct.
Enabling encryption for images in Amazon ECR using AWS KMS ensures that the artifacts are securely stored and protected from unauthorized access.
- B. Incorrect.
Amazon S3 is not a recommended service for storing Docker images. Amazon ECR is the appropriate service for managing Docker images.
- C. Correct.
Using Amazon ECR repository policies to grant access only to specific IAM roles and ECS tasks ensures that only authorized systems can access the artifacts.
- D. Correct.
Implementing image scanning in Amazon ECR helps detect vulnerabilities and ensures that the artifacts being used are secure and compliant with security policies.
- E. Incorrect.
Storing Docker images on an EC2 instance is not an operationally efficient or secure approach when Amazon ECR is specifically designed for this use case.