MLA-C01 Question 455
Select 3You are a Machine Learning Engineer managing a CI/CD pipeline for deploying machine learning models on AWS. To ensure security best practices, what steps should you take to protect sensitive data, such as API keys and credentials, used in the pipeline?
- A
Store sensitive data as plaintext environment variables in the pipeline configuration.
- B
Use AWS Secrets Manager or AWS Systems Manager Parameter Store to securely store credentials and access them during pipeline execution.
- C
Restrict IAM roles and policies associated with the pipeline to the minimum permissions required.
- D
Enable encryption for data in transit and at rest in the CI/CD pipeline.
- E
Embed sensitive credentials directly into the source code repository for easy access.
Show answer and explanation
Correct answers: B, C, D
Explanation
To ensure security best practices in a CI/CD pipeline, sensitive data must be managed securely using services like AWS Secrets Manager or AWS Systems Manager Parameter Store. Additionally, IAM roles and permissions must follow the principle of least privilege, and encryption should be enabled for data in transit and at rest. Storing sensitive data as plaintext or embedding it directly in the source code poses significant security risks and should be avoided.
- A. Incorrect.
Storing sensitive data as plaintext environment variables is not secure because anyone with access to the pipeline configuration could potentially view the credentials.
- B. Correct.
Using AWS Secrets Manager or AWS Systems Manager Parameter Store is a secure and recommended practice for managing sensitive data, as these services encrypt the data and allow controlled access.
- C. Correct.
Restricting IAM roles and policies to the minimum permissions required follows the principle of least privilege, reducing the risk of unauthorized access to resources.
- D. Correct.
Enabling encryption for data in transit and at rest ensures that sensitive information is protected from being intercepted or accessed by unauthorized parties.
- E. Incorrect.
Embedding sensitive credentials directly into the source code repository is highly insecure, as it exposes sensitive data to anyone with access to the repository and increases the risk of data breaches.