A company stores its Python-based application code in AWS CodeCommit. The company uses AWS CodePipeline to deploy the application. The CodeCommit repository and the CodePipeline pipeline are deployed

Question

Options

• ACreate a new CodeBuild project. Configure the project to run a security scan on the code by using
• BCreate a new CodeBuild project. Configure the project to run a security scan on the code by using
• CUpdate the IAM role that is attached to CodePipeline to include sufficient permissions to invoke
• DUpdate the IAM role that is attached to CodePipeline to include sufficient permissions to invoke

• A
  73% (29)
• B
  15% (6)
• C
  5% (2)
• D
  8% (3)

Explanation

Amazon CodeGuru Security is a specialized tool for analyzing Python (and Java) code for security vulnerabilities. It provides detailed feedback on potential security issues and recommendations for remediation, making it ideal for scanning application code before deploying it to production. CodeBuild is used to create a stage in CodePipeline that runs the vulnerability scans. CodeBuild supports running custom commands and scripts, making it a flexible solution for invoking CodeGuru Security to scan the code. If vulnerabilities are found, CodeBuild can raise an error to stop the pipeline from progressing to the deployment stage. By adding a new CodeBuild stage in the CodePipeline before deployment, you ensure that the security scan runs as part of the pipeline. This provides an automatic mechanism to stop deployments if vulnerabilities are found, meeting the security team's requirement to block non- compliant code from being deployed. The solution involves creating an IAM role with the necessary permissions to run the security scan using CodeGuru Security within the CodeBuild project. This ensures that the project has sufficient access while adhering to least privilege principles.

No community discussion yet for this question.