DVA-C02 · Question #582
A developer is using an AWS CloudFormation template to create a pipeline in AWS CodePipeline. The template creates an Amazon S3 bucket that the pipeline references in a source stage. The template…
The correct answer is C. Apply an S3 bucket policy that ensures the pipeline sends only encrypted objects to the S3. Ensuring that pipeline artifacts are encrypted with a customer-managed AWS KMS key involves configuring the S3 bucket policy to require encryption. This policy ensures all objects uploaded to the bucket are encrypted with the specified KMS key.
Question
A developer is using an AWS CloudFormation template to create a pipeline in AWS CodePipeline. The template creates an Amazon S3 bucket that the pipeline references in a source stage. The template also creates an AWS CodeBuild project for a build stage. The pipeline sends notifications to an Amazon SNS topic. Logs for the CodeBuild project are stored in Amazon CloudWatch Logs. The company needs to ensure that the pipeline's artifacts are encrypted with an existing customer-managed AWS KMS key. The developer has granted the pipeline permissions to use the KMS key. Which additional step will meet these requirements?
Options
- ACreate an Amazon S3 gateway endpoint that the pipeline can access.
- BIn the CloudFormation template, use the KMS key to encrypt the logs in CloudWatch Logs.
- CApply an S3 bucket policy that ensures the pipeline sends only encrypted objects to the S3
- DConfigure the notification topic to use the existing KMS key to enable encryption with the existing
How the community answered
(39 responses)- A3% (1)
- B13% (5)
- C77% (30)
- D8% (3)
Explanation
Ensuring that pipeline artifacts are encrypted with a customer-managed AWS KMS key involves configuring the S3 bucket policy to require encryption. This policy ensures all objects uploaded to the bucket are encrypted with the specified KMS key.
Community Discussion
No community discussion yet for this question.