Question

A development team uses AWS CodeBuild to build a containerized application. The build process needs a database password that is stored in AWS Systems Manager Parameter Store as a SecureString parameter named /myapp/db/password. The team wants the value injected as an environment variable during the build without hardcoding the secret anywhere in the repository or buildspec. What is the recommended way to accomplish this?

Accepted Answer

In the buildspec env section, define the variable under 'parameter-store' with the Parameter Store name as its value, and grant the CodeBuild service role ssm:GetParameters permission.

Answer

Store the plaintext password directly in the buildspec env 'variables' block and encrypt the entire buildspec file with KMS.

Answer

Add the password as a plaintext CodeBuild project environment variable of type PLAINTEXT so it is available at build time.

Answer

Hardcode the password in a Dockerfile ARG and pass it during the docker build command in the build phase.