AWS Certified DevOps Engineer – Professional — Question 71

A security review has identified that an AWS CodeBuild project is downloading a database population script from an Amazon S3 bucket using an unauthenticated request. The security team does not allow unauthenticated requests to S3 buckets for this project.

How can this issue be corrected in the MOST secure manner?

Answer options

• A. Add the bucket name to the AllowedBuckets section of the CodeBuild project settings. Update the build spec to use the AWS CLI to download the database population script.
• B. Modify the S3 bucket settings to enable HTTPS basic authentication and specify a token. Update the build spec to use cURL to pass the token and download the database population script.
• C. Remove unauthenticated access from the S3 bucket with a bucket policy. Modify the service role for the CodeBuild project to include Amazon S3 access. Use the AWS CLI to download the database population script.
• D. Remove unauthenticated access from the S3 bucket with a bucket policy. Use the AWS CLI to download the database population script using an IAM access key and a secret access key.

Correct answer: C

Explanation

The correct answer is C because it ensures that unauthenticated access is restricted through a bucket policy while also providing the CodeBuild project with the necessary permissions to access the S3 bucket securely. Option A does not adequately secure access, B introduces unnecessary complexity with authentication, and D is less secure as it involves embedding IAM keys directly in the build process.