Encrypt CodePipeline Artifacts at Rest and In Transit
A company is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage (CodeCommit), a build stage (CodeBuild), and a deploy stage (CodeDeploy). The security team requires that all artifacts be encrypted at rest and in transit. Which configuration ensures encryption for all stages?
Quick Answer
The correct answer is to enable default encryption on the S3 artifact bucket and ensure all connections use HTTPS. This configuration directly addresses the requirement to encrypt CodePipeline artifacts at rest and in transit because the S3 bucket stores all pipeline artifacts, and enabling default encryption—such as SSE-S3 or SSE-KMS—secures them at rest, while HTTPS encrypts data moving between pipeline stages. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this question tests your understanding that CodePipeline does not automatically encrypt artifacts; you must explicitly configure the S3 bucket, and that CodeCommit and CodeBuild already enforce HTTPS by default, making additional steps unnecessary. A common trap is assuming KMS encryption is automatically applied to CodePipeline artifacts, but it is not—you must set it on the bucket. Memory tip: think "Bucket first, HTTPS always" to remember that encryption at rest starts with the S3 bucket, and transit is covered by the protocol.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable default encryption on the S3 artifact bucket and ensure all connections use HTTPS.
Enabling default encryption on the S3 artifact bucket ensures that all artifacts stored in the bucket are encrypted at rest. Additionally, ensuring all connections use HTTPS provides encryption in transit for all communications between pipeline stages (e.g., CodeBuild downloading from S3, CodeDeploy pulling artifacts). Option A is incorrect because enabling KMS encryption on the artifact bucket is not automatic with CodePipeline; you must configure it. Moreover, SSH is not used for CodeCommit; HTTPS is the primary method. Option B is incorrect because ACM certificates are used for securing custom domain endpoints, not for encrypting pipeline artifacts at rest or in transit by default. Option D is incorrect because CodePipeline does not have a built-in encryption feature; encryption must be configured on the S3 bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable AWS KMS encryption on the CodePipeline artifact bucket and use SSH for CodeCommit.
Why it's wrong here
SSH provides encryption but is not required.
- ✗
Use an AWS Certificate Manager (ACM) certificate for CodeBuild and CodeDeploy endpoints.
Why it's wrong here
Not applicable; ACM is for load balancers.
- ✓
Enable default encryption on the S3 artifact bucket and ensure all connections use HTTPS.
Why this is correct
Ensures encryption at rest and in transit.
- ✗
Encrypt the CodePipeline artifact using the pipeline's built-in encryption feature.
Why it's wrong here
CodePipeline does not have built-in encryption; uses S3.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 251 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CodePipeline to deploy a web application to an Auto Scaling group. The security team requires that all artifacts in the pipeline be encrypted at rest. The pipeline uses an S3 bucket as the artifact store. Which combination of actions should the DevOps engineer take to meet this requirement with minimal operational overhead?
hard- A.Use AWS Certificate Manager to encrypt the artifacts.
- ✓ B.Enable S3 default encryption with SSE-S3 on the artifact bucket.
- C.Use an AWS Lambda function to encrypt artifacts after each pipeline stage.
- D.Create a customer-managed KMS key and configure the pipeline to use it for artifact encryption.
Why B: Enabling S3 default encryption with SSE-S3 on the artifact bucket is the simplest way to encrypt all objects at rest with minimal operational overhead. SSES3 uses S3-managed keys, requiring no additional key management or permissions. Option A is wrong because AWS Certificate Manager provides TLS certificates, not encryption for S3 objects. Option C is wrong because using a Lambda function to encrypt artifacts after each stage adds unnecessary complexity and does not automatically encrypt all artifacts, especially existing ones. Option D is wrong because creating a customer-managed KMS key introduces additional overhead for key management and permissions, which is not minimal.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.