DOP-C02 Question 121
Single answerYour organization uses an AWS CodePipeline to deploy a critical web application. A recent security audit revealed that the application code deployment process does not meet compliance requirements because there is no approval step before changes are deployed to production. You have been tasked with quickly adding an approval step to ensure that production deployments are explicitly reviewed and approved by a human. How can you achieve this in the most efficient way using AWS services?
- A
Add an AWS Lambda function to the CodePipeline to pause the pipeline and wait for manual approval.
- B
Insert a Manual Approval action into the CodePipeline before the production deployment stage.
- C
Create an Amazon SNS topic to send notifications and manually pause the pipeline when approval is required.
- D
Configure AWS CodeDeploy to require manual approval before deploying to production.
Show answer and explanation
Correct answer: B
Explanation
The most efficient way to add an approval step to an AWS CodePipeline is to use a Manual Approval action. This feature is natively supported by CodePipeline and allows for explicit human approval before the pipeline proceeds to the next stage, such as deploying to production. While other options might involve custom implementations or are unrelated to CodePipeline's approval mechanism, they are not as efficient or appropriate for this scenario.
- A. Incorrect.
AWS Lambda cannot directly pause a pipeline for manual approval. While Lambda could be used in complex scenarios, it is not an efficient or native solution for adding approval steps in CodePipeline.
- B. Correct.
CodePipeline allows you to natively add a Manual Approval action, which is designed specifically for this purpose. This is the most efficient and straightforward solution to meet the requirement.
- C. Incorrect.
Amazon SNS can send notifications, but it does not provide a way to pause the pipeline or implement an approval step. Manual intervention to pause the pipeline is not an efficient or reliable solution.
- D. Incorrect.
AWS CodeDeploy does not provide built-in support for manual approval steps before deployment. This functionality is better handled at the CodePipeline level.