A SaaS startup builds its API with an AWS CodeBuild project. The build runs unit tests that need a read-only database password, and then it pushes an image to Amazon ECR.
The password is stored in AWS Secrets Manager under a secret named prod/reporting/readonly. The developers want the password available as an environment variable during the build, without writing it into the buildspec file or into the project's environment settings in plaintext. Security also requires that the password never appear in build logs.
Which approach meets these requirements?
Choose one answer.
AA. Add the password as a plaintext environment variable on the CodeBuild project, and set the variable type to Plaintext so that the build can read it without extra permissions.
BB. Commit the password to the repository in a .env file, exclude that file from the Docker image, and read it in the install phase of the buildspec.
CC. In the buildspec env section, add a secrets-manager entry that maps the variable name to the secret, and give the CodeBuild service role permission to read that secret.
DD. Copy the password into an S3 object that the build downloads with an unsigned request, and delete the object at the end of each build.
Show the answer and explanation
Answer: C
A. Wrong: Plaintext project variables are visible to anyone who can view the project, and a build that echoes them writes the value to its logs. The requirement is to keep the password out of plaintext project settings.
B. Wrong: A password committed to source control stays in the repository history even after the file is deleted. Anyone with read access to the repository could recover it.
C. Right: Correct. CodeBuild resolves the secret at build time and exposes it as an environment variable, so the password never appears in the buildspec or the project settings. The service role needs read access to that one secret and nothing more. Learn more: Build specification reference for CodeBuild (opens in a new tab)
CodeBuild reads Secrets Manager values through the buildspec env section and exposes them as environment variables during the build. This keeps the password out of the buildspec and the project settings, and the service role needs only read access to that secret. Plaintext variables, committed files and public objects all expose the value to people who should not see it.
Want more on Build and deployment secrets? The 5 full-length practice sets have 5 more Build and deployment secrets questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →