DOP-C02 Question 48
Select 2Your company is using AWS CodePipeline to automate the build and deployment of an application. The pipeline retrieves source code from a private Git repository and uses AWS CodeBuild to build the application. The build artifacts are then stored in an S3 bucket before being deployed to an Amazon ECS service. Compliance requirements mandate that artifacts must be encrypted at rest and only accessible to the deployment process. How can you ensure secure management of the artifacts in this scenario?
- A
Enable server-side encryption with an AWS KMS-managed key (SSE-KMS) on the S3 bucket.
- B
Configure an S3 bucket policy to restrict access to only the IAM role used by the deployment process.
- C
Use AWS Secrets Manager to store and retrieve the S3 bucket name and access credentials.
- D
Enable versioning on the S3 bucket to retain previous versions of the build artifacts.
- E
Use a public S3 bucket to simplify deployment and ensure availability.
Show answer and explanation
Correct answers: A, B
Explanation
To meet compliance requirements and securely manage artifacts, the artifacts must be encrypted at rest and access must be restricted. Enabling server-side encryption with AWS KMS-managed keys ensures encryption, while restricting access using an S3 bucket policy ensures only authorized entities can access the artifacts. These measures align with AWS security best practices and compliance needs.
- A. Correct.
Correct: Enabling server-side encryption with an AWS KMS-managed key ensures that the artifacts are encrypted at rest, meeting the compliance requirements.
- B. Correct.
Correct: Configuring an S3 bucket policy to restrict access ensures that only authorized entities, like the deployment process, can access the artifacts.
- C. Incorrect.
Incorrect: AWS Secrets Manager is used for securely managing secrets such as database credentials, not for managing the security of artifacts stored in S3.
- D. Incorrect.
Incorrect: While versioning helps track changes to artifacts, it does not directly address encryption or access control for compliance.
- E. Incorrect.
Incorrect: Using a public S3 bucket exposes the artifacts to anyone on the internet, violating compliance requirements and security best practices.