A buildspec exports an IAM user’s access key to push to Amazon ECR and call SageMaker. The key lives in the CodeBuild project environment. What should replace it?
Select an answer to reveal the explanation.
Short Explanation
A buildspec exports an IAM user access key to push to ECR. Use the CodeBuild or CodePipeline service role instead, and Secrets Manager if a secret is still required. Committing the key is worse than an env var.
Full Explanation
CI should use the CodeBuild or CodePipeline service role, not a buried IAM user access key. Secrets Manager holds any remaining secret. CodeBuild can assume that role; Comprehend is not a credential, and committing the key is worse than an env var.