DOP-C02 Practice Question 12: CodeBuild Secrets Manager Env

The buildspec's env/secrets-manager mapping takes a reference key of the form secret-id:json-key:version-stage:version-id, and CodeBuild resolves it into an environment variable when the build starts. If you give neither a version stage nor a version ID, CodeBuild retrieves the version labelled AWSCURRENT. Secrets Manager moves that label to the new version at each rotation, so every build gets the newest token with no buildspec change. CodeBuild also hides strings that come from Secrets Manager in its logs, which covers the masking requirement. The buildspec now holds only the secret's name, so the token itself is gone from source control, and the build's service role needs permission to read that secret.

Option A only moves the plaintext value from one place to another. The CodeBuild docs strongly discourage storing sensitive values in environment variables, because they can be displayed in plain text through the CodeBuild console and the AWS CLI. That breaks the "not in the build project configuration" requirement. Plaintext variables are also not masked in logs.

Option B keeps the token out of the repository, but CodeBuild masks only values that come from Parameter Store or Secrets Manager, so a value downloaded from S3 is not masked. It also leaves rotation for the team to build.

Option C is correct right up to the pin. A reference to a specific version-id keeps returning that exact version after rotation, so the build either uses a stale token or needs a buildspec edit every 30 days, which is exactly what the stem rules out.

Reference: Build specification reference for CodeBuild