MLA-C01 Question 457
Select 3You are designing a CI/CD pipeline for deploying a machine learning model on AWS. Security is a critical concern, and you want to ensure that the pipeline follows AWS security best practices. Which of the following actions should you take to secure your CI/CD pipeline?
- A
Use an IAM role with the least privilege access for the CI/CD pipeline
- B
Store pipeline secrets, such as database credentials, in plaintext within the code repository
- C
Enable logging and monitoring for pipeline activities using Amazon CloudWatch or AWS CloudTrail
- D
Use encryption to secure artifacts and data in transit and at rest
- E
Allow developers to directly access the production environment for quick debugging
Show answer and explanation
Correct answers: A, C, D
Explanation
To secure a CI/CD pipeline on AWS, it is essential to follow security best practices, such as using IAM roles with least privilege, enabling logging and monitoring, and encrypting data at every stage. Storing sensitive information in plaintext or allowing direct access to production environments contradicts AWS security guidelines and increases the risk of breaches.
- A. Correct.
This is correct because following the principle of least privilege ensures that the CI/CD pipeline has only the permissions it needs to perform its tasks, reducing security risks.
- B. Incorrect.
This is incorrect because storing sensitive information such as database credentials in plaintext within the code repository is a security vulnerability. AWS Secrets Manager or AWS Systems Manager Parameter Store should be used to manage sensitive information securely.
- C. Correct.
This is correct because enabling logging and monitoring using tools like Amazon CloudWatch or AWS CloudTrail helps track pipeline activities, detect anomalies, and ensures accountability for actions taken during the CI/CD process.
- D. Correct.
This is correct because encrypting data and artifacts in transit and at rest is a fundamental security best practice to prevent unauthorized access.
- E. Incorrect.
This is incorrect because allowing direct access to the production environment introduces significant security risks, including accidental or intentional modifications. Debugging should be done in staging or isolated environments.