CodeBuild connects to a test database.
Do not place the password in a buildspec or plaintext environment variable.
Which method is most appropriate?
Grant the CodeBuild service role permission to retrieve the secret from Secrets Manager at runtime.
Detailed explanation
The credential remains in source control and can be exposed to readers.
The credential remains in source control and can be exposed to readers.
DNS is not a CI/CD secret-management service.
DNS is not a CI/CD secret-management service.
The build obtains only the required secret at runtime and can use rotation and audit controls.
The build obtains only the required secret at runtime and can use rotation and audit controls.
Public storage exposes the credential to unintended users.
Public storage exposes the credential to unintended users.
Check official documentation
Compare the following points with the official documentation.
AWS CodeBuild Secrets Manager environment variablesの公式説明を確認する。
What to confirm
ビルド設定と秘密管理サービスを分離できる。
Key points
- Secrets Manager
- CodeBuild
- IAM role
Notes
- Environment: AWS公式SOA-C03試験ガイドとAWS公式ドキュメントの確認
- Confirm current AWS service behavior in the official documentation.
Foundation review
Runtime retrieval
Fetching the secret during the build keeps it out of the repository and static build definition.
Least exposure
The build role should read only the secret required for its task.