A DevOps engineer needs to implement a CI/CD pipeline in an AWS account. The pipeline must consume sensitive database credentials that are stored in an AWS Systems Manager Parameter Store parameter…

Question

Options

• AUse an advanced tier Parameter Store parameter to store the database credentials in the central
• BCreate an IAM role in the AWS account that hosts the CI/CD pipeline. Add the full ARN of the
• CUse a standard tier Parameter Store parameter to store the database credentials in the central
• DUse an AWS KMS managed key to encrypt the parameter. Grant decrypt permissions for the
• EUse a customer managed AWS KMS key to encrypt the parameter. Grant decrypt permissions for
• FCreate an AWS Resource Access Manager (AWS RAM) resource share in the central AWS

• A
  67% (14)
• B
  5% (1)
• C
  19% (4)
• D
  10% (2)

Explanation

The parameter must be an advanced tier parameter to be eligible for cross-account sharing through AWS Resource Access Manager. Encrypting a SecureString parameter for cross-account use requires a customer managed AWS KMS key so the central account can grant decrypt permissions to the CI/CD account. Sharing the parameter with the CI/CD account is accomplished by creating an AWS RAM resource share in the central account and adding the parameter to the share.

No community discussion yet for this question.