DOP-C02 Question 46
Select 3Your team is developing a CI/CD pipeline for a microservices-based application. The pipeline uses AWS CodePipeline, and the build artifacts are stored in an S3 bucket. The artifacts include application binaries, configuration files, and deployment scripts. Due to compliance requirements, you must ensure the artifacts are securely managed and accessible only to authorized entities. Which combination of actions should you take to meet these requirements?
- A
Enable default encryption on the S3 bucket using an AWS KMS-managed key.
- B
Grant public read access to the S3 bucket to ensure easy retrieval of artifacts.
- C
Use S3 bucket policies and IAM roles to restrict access to the bucket based on the principle of least privilege.
- D
Enable versioning on the S3 bucket to maintain a history of artifact changes.
- E
Use AWS Secrets Manager to store and retrieve the artifacts securely.
Show answer and explanation
Correct answers: A, C, D
Explanation
To securely manage artifacts in an S3 bucket, you must enable encryption to protect data at rest and use bucket policies and IAM roles to enforce access control. Versioning helps maintain a history of changes and provides rollback capabilities. Avoid granting public access to the bucket and use tools like Secrets Manager only for their intended purpose, such as managing access credentials.
- A. Correct.
This ensures that all artifacts stored in the S3 bucket are encrypted at rest, meeting security and compliance requirements for data protection.
- B. Incorrect.
Granting public read access to the S3 bucket violates security best practices and would expose sensitive artifacts to unauthorized users.
- C. Correct.
Using S3 bucket policies and IAM roles ensures that only authorized entities can access the artifacts, adhering to the principle of least privilege.
- D. Correct.
Enabling versioning on the S3 bucket allows you to track changes to artifacts and roll back to previous versions if necessary, which is useful for secure artifact management.
- E. Incorrect.
AWS Secrets Manager is not intended for storing artifacts like application binaries or deployment scripts. It is designed for managing secrets, such as API keys or database credentials.