Question

A DevOps team runs integration tests in AWS CodeBuild as part of a CodePipeline. The tests require a database password and a third-party API key. Currently these values are hardcoded as plaintext environment variables in the CodeBuild project configuration, and a security audit has flagged this. The team wants CodeBuild to retrieve the secrets at build time without exposing them in the project definition, build logs, or the buildspec file, while keeping the buildspec portable across accounts. Which approach BEST meets these requirements?

Accepted Answer

Store the values in AWS Secrets Manager, reference them in the buildspec env/secrets-manager section, and grant the CodeBuild service role secretsmanager:GetSecretValue permission.

Answer

Encrypt the plaintext environment variables with a customer-managed KMS key in the CodeBuild project and grant the service role kms:Decrypt.

Answer

Pass the secrets as CodePipeline stage variables and map them into the CodeBuild action's environment variable overrides.

Answer

Store the values in an encrypted S3 object and add a build phase command that downloads and exports them before the tests run.