Quick Answer

The answer is to configure the S3 bucket to enforce encryption in transit via a bucket policy that denies HTTP requests, add a CodeBuild step for static code analysis to scan for secrets and vulnerabilities, and use AWS Secrets Manager to store and rotate sensitive credentials. This combination directly meets the security requirements because the bucket policy ensures all artifacts are encrypted during upload and download, the CodeBuild scan acts as a gated security check before deployment, and Secrets Manager centralizes credential management without hardcoding secrets into code. On the SAA-C03 exam, this scenario tests your ability to integrate security into a CI/CD pipeline, often with a trap where candidates confuse server-side encryption (SSE-S3) with in-transit encryption—remember that S3 bucket policies can enforce HTTPS, but SSE alone does not protect data during transfer. A useful memory tip is “Scan, Store, Secure Transit”—the three S’s for a secure pipeline.