Exams / DVA-C02 / CI/CD with CodePipeline and CodeBuild / Question 2
DVA-C02 practice question: CI/CD with CodePipeline and CodeBuild (2 of 3)
Deployment A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A CodeBuild project must use a database password stored in AWS Secrets Manager. The secret is named prod/db and holds JSON with a key named password. The developer wants the value available to build commands as DB_PASSWORD without writing it in the buildspec or project settings. Which buildspec setting does this?
Choose one answer.
- AA. Under env, a secrets-manager entry of DB_PASSWORD: prod/db:password
- BB. Under env, a variables entry of DB_PASSWORD: prod/db:password
- CC. Under env, a parameter-store entry of DB_PASSWORD: prod/db:password
- DD. Under env, an exported-variables entry that lists DB_PASSWORD
Show the answer and explanation
Answer: A
- A. Right: Correct. The secrets-manager mapping uses secret-id:json-key, so CodeBuild fetches the password key from the secret at build time.
- B. Wrong: Plain variables are literal values, so DB_PASSWORD would just contain the text prod/db:password.
- C. Wrong: The parameter-store mapping reads Systems Manager parameters. The secret is in Secrets Manager.
- D. Wrong: exported-variables names variables to pass to later CodePipeline stages. It does not fetch any value from Secrets Manager.
Explanation
A buildspec can pull secrets at build time. Under env, secrets-manager maps a local variable to secret-id:json-key (with optional version stage or ID), and parameter-store maps one to a Parameter Store name. The CodeBuild service role must be allowed to read the secret. This keeps secrets out of source control and build settings.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.