MLA-C01 Question 454
Select 3You are managing a CI/CD pipeline for deploying machine learning models on AWS. The pipeline accesses sensitive resources such as Amazon S3 buckets containing training data and an Amazon SageMaker endpoint for model deployment. Which practices should you implement to ensure the security of the pipeline?
- A
Use AWS Secrets Manager to store and retrieve sensitive credentials used in the pipeline.
- B
Grant the pipeline's IAM role wide permissions, such as AdministratorAccess, to ensure it has access to all required resources.
- C
Enable encryption at rest for any data stored in Amazon S3 that the pipeline interacts with.
- D
Use code signing to validate the integrity and authenticity of artifacts deployed through the pipeline.
- E
Store sensitive credentials in plaintext within the pipeline configuration for quick access.
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure a CI/CD pipeline in AWS, it is critical to adhere to security best practices such as managing sensitive credentials securely using AWS Secrets Manager, enforcing encryption for data at rest, and using code signing to ensure artifact integrity. Additionally, the principle of least privilege must be followed to minimize the risk of unauthorized access. Avoid practices like granting broad permissions or storing sensitive data in plaintext, as they pose significant security risks.
- A. Correct.
Using AWS Secrets Manager to store and retrieve sensitive credentials is a security best practice. It ensures that sensitive information is not exposed in plaintext and is managed securely.
- B. Incorrect.
Granting wide permissions, such as AdministratorAccess, violates the principle of least privilege and poses a significant security risk. The pipeline should only have permissions necessary to perform its tasks.
- C. Correct.
Enabling encryption at rest for data stored in Amazon S3 ensures that sensitive information is protected from unauthorized access.
- D. Correct.
Using code signing ensures that artifacts in the pipeline are not tampered with and verifies their authenticity, which is a crucial security practice.
- E. Incorrect.
Storing sensitive credentials in plaintext within the pipeline configuration is insecure and exposes them to unauthorized access, violating security best practices.