All in-house quality-control apps are containerized. Jenkins runs on Amazon EC2 instances that need ongoing patching and upgrades. The compliance officer requires build artifacts to be encrypted because they contain IP. What is the most maintainable way to meet this requirement?

Replacing the EC2-based Jenkins with AWS CodeBuild is the most maintainable solution. CodeBuild is a fully managed service that eliminates the operational overhead of patching and upgrading Jenkins instances. It natively supports containerized builds, aligning with the existing quality-control apps. CodeBuild also offers built-in artifact encryption, satisfying the compliance requirement for protecting intellectual property without needing to manage separate encryption mechanisms. Automating patching on EC2 instances still leaves the operational burden of managing Jenkins. Migrating Jenkins to ECS improves scalability but doesn't inherently address artifact encryption as simply as CodeBuild. Using AWS CodePipeline with Secrets Manager for encryption is overly complex; Secrets Manager is for credentials, not general artifact encryption.