MLA-C01 Question 453
Select 3You are designing a CI/CD pipeline for deploying a machine learning model in AWS. Security is a top priority since the pipeline handles sensitive data and proprietary code. Which of the following are security best practices you should implement in your CI/CD pipeline?
- A
Use AWS Secrets Manager to securely store and retrieve credentials used in the pipeline.
- B
Grant the CI/CD pipeline full administrative permissions to the AWS account for easier management.
- C
Implement fine-grained IAM roles and policies that provide the pipeline only the permissions it needs.
- D
Use AWS CodePipeline with encryption enabled for artifacts and data in transit.
- E
Store sensitive environment variables in plaintext within the pipeline configuration for easier debugging.
Show answer and explanation
Correct answers: A, C, D
Explanation
Security best practices for CI/CD pipelines in AWS include using services like AWS Secrets Manager to manage credentials securely, implementing the principle of least privilege with fine-grained IAM roles, and ensuring encryption for data at rest and in transit. Avoid practices such as granting broad permissions or storing sensitive information in plaintext, as these can create significant security risks.
- A. Correct.
Correct. AWS Secrets Manager allows you to securely store and retrieve sensitive credentials, reducing the risk of exposing secrets in plaintext or configuration files.
- B. Incorrect.
Incorrect. Providing full administrative permissions violates the principle of least privilege and exposes the account to unnecessary security risks.
- C. Correct.
Correct. Applying fine-grained IAM roles and policies ensures that the pipeline has only the permissions necessary for its tasks, minimizing potential attack surfaces.
- D. Correct.
Correct. Enabling encryption for artifacts and data in transit ensures that sensitive information is protected from unauthorized access during storage and transmission.
- E. Incorrect.
Incorrect. Storing sensitive environment variables in plaintext is a security vulnerability and should be avoided, as it exposes secrets to unauthorized access.