DOP-C02 Configuration Management and IaC Practice Question
A company uses AWS CodeBuild to compile and test code. The buildspec.yml file includes commands that require access to a private S3 bucket. The DevOps engineer wants to securely provide AWS credentials to the build project. What is the recommended approach?
⚠ Common exam trap
It's easy for candidates to confuse CodeBuild with EC2-based build environments and incorrectly assume an instance profile can be used, or they may think environment variables are a secure way to pass credentials, overlooking that the values must still be stored in the project configuration.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a service role for CodeBuild with appropriate permissions
The recommended approach is to use a service role for CodeBuild with appropriate permissions. CodeBuild can assume an IAM role that grants the build project access to the private S3 bucket, eliminating the need to manage long-term credentials. This follows AWS best practices for secure credential management by using temporary, automatically rotated credentials via the AWS Security Token Service (STS).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use a service role for CodeBuild with appropriate permissions
Why this is correct
Using a service role for CodeBuild is the secure approach because CodeBuild assumes the role via the `codebuild.amazonaws.com` service principal to obtain temporary credentials for API calls such as pulling source from S3 or publishing artifacts. The role is configured with an IAM trust policy and a permissions policy that grants only the needed actions, adhering to least privilege. Temporary session credentials are automatically rotated and never written to disk, logs, or build scripts.
- ✗
Store the AWS access key ID and secret access key in the buildspec.yml file
Why it's wrong here
Storing the AWS access key ID and secret access key directly in `buildspec.yml` exposes long-term IAM user credentials in source control, which can be read by anyone with repository access and are often committed accidentally. These static keys do not expire, are rarely rotated after being leaked, and extend the attack surface far beyond the build environment. AWS best practice is to never embed credentials in build files; instead, rely on the CodeBuild service role or a secrets service.
- ✗
Use an EC2 instance profile attached to the build environment
Why it's wrong here
An EC2 instance profile is a construct for assigning an IAM role to an Amazon EC2 instance that you launch and manage yourself, but CodeBuild provisions isolated, ephemeral build containers on AWS-managed infrastructure. You cannot attach an instance profile to the build environment because the build is not running on a persistent EC2 instance you control. Consequently, the instance profile has no effect on the CodeBuild project's permissions, making this option technically invalid.
- ✗
Pass the credentials as environment variables in the build project configuration
Why it's wrong here
Storing credentials as environment variables in the CodeBuild project configuration risks exposure through the AWS Console, CloudTrail logs, or build output, especially if the project is misconfigured to print variables during debugging. While CodeBuild supports encrypted environment variables via KMS, the value is still delivered as a plaintext variable in the build container, and managing long-term keys in this manner does not provide the automatic temporary credentials that a service role offers. This approach also complicates rotation and creates a shared-secret problem.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.