DOP-C02 Question 26
Single answerYour organization is using AWS CodePipeline for its CI/CD workflows. A new requirement mandates that a manual approval step must be added before deploying to production. You also need to ensure that only a specific IAM user group, 'ReleaseManagers', can approve the deployment. Which approach best meets this requirement?
- A
Add a manual approval action in CodePipeline and attach an IAM policy to the pipeline that allows only the 'ReleaseManagers' group to approve the action.
- B
Add a manual approval action in CodePipeline and configure an SNS topic to send approval notifications to the 'ReleaseManagers' group.
- C
Add a manual approval action in CodePipeline and configure an IAM condition in the approval action's permissions to restrict approvals to the 'ReleaseManagers' group.
- D
Add a manual approval action in CodePipeline and restrict access by using AWS Organizations Service Control Policies (SCPs) to ensure only the 'ReleaseManagers' group can approve.
Show answer and explanation
Correct answer: C
Explanation
To ensure that only members of the 'ReleaseManagers' IAM user group can approve the deployment, you should configure an IAM condition in the manual approval action's permissions. This allows you to define fine-grained access control for who can execute approvals in CodePipeline. Other options either lack the required granularity or are unrelated to controlling approval permissions.
- A. Incorrect.
Incorrect: While adding a manual approval action in CodePipeline is correct, IAM policies cannot directly control who can approve manual approval actions.
- B. Incorrect.
Incorrect: Configuring an SNS topic for notifications does not restrict who can approve the manual approval action. Notifications are unrelated to access control for approvals.
- C. Correct.
Correct: IAM conditions can be used to restrict access to specific actions like approvals in CodePipeline. This ensures that only users in the 'ReleaseManagers' group can approve the deployment.
- D. Incorrect.
Incorrect: AWS Organizations SCPs are used to set account-level permissions and cannot be used to restrict actions for specific user groups within an account.