DOP-C02 Question 92
Single answerYour team manages a CI/CD pipeline using AWS CodePipeline for deploying a serverless application. A recent security audit highlighted the need to ensure that all artifacts used during the pipeline execution are securely encrypted at rest. What is the most appropriate way to achieve this requirement?
- A
Configure AWS CodePipeline to use an AWS KMS-managed key (CMK) for artifact encryption.
- B
Enable encryption on the S3 bucket used by AWS CodePipeline and rely on default S3-managed encryption keys.
- C
Use AWS Secrets Manager to store and retrieve encryption keys for securing the artifacts.
- D
Implement an IAM policy that restricts access to the artifacts in the S3 bucket.
Show answer and explanation
Correct answer: A
Explanation
To meet the security requirement for encrypting artifacts at rest in a CodePipeline workflow, configuring an AWS KMS-managed key (CMK) is the most appropriate solution. This ensures compliance with encryption standards and provides full control over the encryption keys. Other options either do not address the encryption requirement specifically or are not designed for this purpose.
- A. Correct.
This is the correct approach. AWS CodePipeline supports encryption of artifacts using an AWS KMS-managed key (CMK). This ensures that artifacts are securely encrypted at rest and meets the security requirement.
- B. Incorrect.
While enabling encryption on the S3 bucket is a good step, relying on default S3-managed keys does not provide the same level of control and security as using an AWS KMS-managed key.
- C. Incorrect.
AWS Secrets Manager is designed for managing secrets and does not directly handle artifact encryption in CodePipeline.
- D. Incorrect.
An IAM policy can restrict access to the artifacts but does not fulfill the requirement to ensure that the artifacts are encrypted at rest.