AWS Certified DevOps Engineer – Professional (DOP-C02) — Question 24

A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.
How can this issue be corrected in the MOST secure manner?

Answer options

• A. Add the bucket name to the AllowedBuckets section of the CodeBuild project settings. Update the build spec to use the AWS CLI to download the database population script.
• B. Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the build spec to use cURL to pass the token and download the database population script.
• C. Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script.
• D. Remove unauthenticated access from the S3 bucket with a bucket policy. Use the AWS CLI to download the database population script using an IAM access key and a secret access key.

Correct answer: C

Explanation

The correct answer is C because it ensures that unauthenticated access is removed through a bucket policy and grants the necessary permissions to the CodeBuild project's service role. This approach adheres to security best practices by using IAM roles, while the other options either introduce less secure methods or do not address the primary issue of unauthorized access correctly.