Build secrets and systematic troubleshooting

Exam alignment: DOP-C02 Domain 1 task statements for pipelines, testing, artifacts, or deployment.

Learning objective

Retrieve secrets safely and diagnose the first failed transition.

Difficulty / Schwierigkeitsgrad	Advanced
Study time / Lernzeit	120 minutes
Prerequisites / Voraussetzungen	Previous lessons in this volume

Professional scenario

A container build leaks a token and developers add broad permissions after AccessDenied.

Core concepts

• Secrets Manager and Parameter Store can inject protected values.
• KMS decrypt may be required in addition to retrieval.
• Classify failures as source, environment, network, IAM, test, artifact, or service.
• Use phase status, logs, API error, and service events as evidence.

Architecture flow

1. Identify the release input and immutable identity.
2. Select the managed AWS control plane and least-privilege role.
3. Execute build, test, artifact, or deployment work.
4. Collect service events, logs, reports, and runtime metrics.
5. Stop, retry, or roll back according to explicit rules.

Decision matrix

Requirement	Preferred choice	Reason
Rotating secret	Secrets Manager	Managed lifecycle
Secure configuration	Parameter Store SecureString	Central parameter path
AccessDenied	Inspect exact API and all policy layers	Avoid broad guesses

Failure modes and troubleshooting

• Secret appears in shell trace.
• GetSecretValue works but KMS denies.
• ECR login works but upload actions are missing.

Security and operations

• Use short-lived service roles and least privilege.
• Encrypt artifacts and protect logs from secret exposure.
• Record changes and approvals for audit.

Hands-on lab

Goal / Ziel: Inject one secret and troubleshoot IAM, network, and artifact failures.

Tasks

1. Create the smallest safe test architecture.
2. Implement or simulate the main workflow.
3. Introduce one controlled failure.
4. Diagnose it from service evidence.
5. Document cleanup and one improvement.

Validation

• The workflow uses an immutable version.
• A required failure blocks promotion.
• The diagnosis identifies the first failed transition.

Cost control / Kostenkontrolle: Keep resources short lived; read cleanup before starting.

Cleanup

1. Delete pipeline/build/deployment resources.
2. Delete temporary artifacts, images, logs, and roles.

Exam traps

• Printing a secret to verify it.
• Adding AdministratorAccess first.

Key takeaways

• Secrets Manager and Parameter Store can inject protected values.
• Use phase status, logs, API error, and service events as evidence.
• Decisions must be justified by requirements and failure behavior.

Review questions

1. What is the immutable release identity?
2. Which evidence proves failure or success?
3. What is the safest recovery action?

Answers

1. A version, digest, or uniquely versioned artifact.
2. Service events, logs, reports, health checks, and runtime metrics.
3. Restore the known-good version using the configured rollback path.