You are the team lead for an application. You have been instructed to make use of Jenkins as the Build provider in AWS CodePipeline. Which of the following options is the best practice?

Answer options:

A.Install Jenkins on an EC2 instance and make sure the instance role has the "codepipeline:*" permission.
B.Add Access Keys in EC2 for the Jenkins server to access CodePipeline.
C.Install Jenkins on an Amazon EC2 instance. Make sure the instance profile grants Jenkins, only the AWS permissions required to perform tasks for your project.
D.Install Jenkins on a Lambda function so that it is serverless and cost-effective.

Answer – C
This is given in the AWS Documentation.
As a best practice, when you use a Jenkins build provider for your pipeline’s build or test action, install Jenkins on an Amazon EC2 instance and configure a separate EC2 instance profile. Make sure the instance profile grants Jenkins, only the AWS permissions required to perform tasks for your project, such as retrieving files from Amazon S3.
The instance profile provides applications running on an Amazon EC2 instance with the credentials to access other AWS services. As a result, you do not need to configure AWS credentials (AWS access key and secret key).
Option A is incorrect because the "codepipeline:*" permission is not suitable as it allows more actions than required.
Option B is incorrect because an instance profile should be used to assign the permissions for Jenkins. There is no need to add access keys.
Option D is incorrect because when adding Jenkins as the build provider in AWS CodePipeline, users cannot install Jenkins on a Lambda function.
For more information on best practices of AWS CodePipeline, see below.
https://docs.aws.amazon.com/codepipeline/latest/userguide/best-practices.html