A third-party software firm is performing deployment for a new application for your firm. A Linux user from this vendor firm needs access permission to execute dependencies before the build phase. Which of the following can be specified to grant the least privilege to the user?

Answer options:

A.Specify run-as for each command in the env block.
B.Specify run-as at the top of build command of phases block.
C.Specify run-as at the top of the buildspec file.
D.Specify run-as at the top of pre_build command of phases block.

Correct Answer – D
To check dependencies for the build phase, users will need access permission for the pre-build command. For this Linux user can be given access permission only for the pre-build phase using run-as at the top of the pre-build phase.
Option A is incorrect as specifying the run-as command in env block will not grant user access to execute dependencies.
Option B is incorrect as a run-as should be specified in the pre-build command to check dependencies before the build command & not in the build command.
Option C is incorrect as using run-as at top of buildspec file will grant user permission globally to all commands.
For more information on BuildSpec Parameters, refer to the following URL-
https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html