Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 75 discussion

B The MOST secure solution that meets the requirement of automatically detecting and preventing hardcoded secrets is to use AWS CodeGuru Reviewer to check the code for any hardcoded secrets, and then update the SAM templates and Python code to retrieve the secrets from AWS Secrets Manager. Option B is the correct answer. By associating the CodeCommit repository with Amazon CodeGuru Reviewer, the code can be checked for any hardcoded secrets during code reviews. When a hardcoded secret is detected, CodeGuru Reviewer will recommend updating the code to retrieve the secret from a secure storage service like AWS Secrets Manager. The DevOps engineer can choose the option to protect the secret and then update the SAM templates and Python code to retrieve the secret from AWS Secrets Manager instead of hardcoding it in the code.

B is correct. CodeGuru Reviewer for security problems. Amazon CodeGuru Profiler is for performance.

B is correct: <implement a solution to automatically detect and prevent hardcoded secrets> means we need CodeGuru reviewer to analyze the code and uncover hardcoded credentials. A and C: no mention of CodeGuru reviewer D: using System Manager Parameter store is a good method to avoid hardcoded credentials. However, the question requires <the MOST secure solution>, so we should use AWS secret manager (option B). It costs more than Para store, but more secure.

I'd say it's C, because the system to examine includes Python code and CodeGuru profiles for Python needs the decorator: https://docs.aws.amazon.com/codeguru/latest/profiler-ug/python-lambda.html

option C https://docs.aws.amazon.com/codeguru/latest/profiler-ug/python-lambda-command-line.html

Definitely B.