MLA-C01 Question 456
Select 3You are designing a CI/CD pipeline to deploy a machine learning model on AWS. Security is a top priority for your organization. Which of the following practices should you implement to ensure the security of your CI/CD pipeline?
- A
Use AWS Secrets Manager to securely store and retrieve sensitive information such as API keys and database credentials.
- B
Configure IAM roles with the 'AdministratorAccess' policy for all pipeline stages to ensure access to required AWS services.
- C
Implement code signing to verify the integrity of application artifacts before deployment.
- D
Enable logging and monitoring for pipeline activities using AWS CloudTrail and Amazon CloudWatch.
- E
Use hardcoded credentials in the pipeline scripts to ensure ease of access during execution.
Show answer and explanation
Correct answers: A, C, D
Explanation
To ensure the security of a CI/CD pipeline, it is essential to follow AWS security best practices such as securely managing sensitive information (e.g., using AWS Secrets Manager), verifying the integrity of deployed artifacts (e.g., through code signing), and maintaining visibility into pipeline activities (e.g., using AWS CloudTrail and Amazon CloudWatch). Avoid practices like assigning overly permissive IAM roles or hardcoding credentials, as these pose significant security risks.
- A. Correct.
Storing sensitive information such as API keys in AWS Secrets Manager prevents exposure of sensitive data and follows AWS security best practices.
- B. Incorrect.
Assigning the 'AdministratorAccess' policy grants overly broad permissions, which violates the principle of least privilege and increases the attack surface.
- C. Correct.
Code signing ensures that the application artifacts have not been tampered with and verifies the integrity of the code being deployed.
- D. Correct.
Logging and monitoring through AWS CloudTrail and Amazon CloudWatch provide visibility into pipeline activities and help detect unauthorized access or suspicious behavior.
- E. Incorrect.
Hardcoding credentials in pipeline scripts is a poor security practice as it increases the risk of credential exposure and is not recommended.