DOP-C02 Question 82
Single answerYour company uses AWS CloudFormation to manage infrastructure as code (IaC). A new requirement mandates that all CloudFormation stacks should enforce strict controls to prevent accidental stack deletion. How can you implement this in the most automated and scalable manner across all CloudFormation stacks?
- A
Enable termination protection for all stacks during stack creation using an AWS Config rule.
- B
Manually enable termination protection for each stack after stack creation.
- C
Create a custom CloudFormation template that enforces termination protection and use it for all stacks.
- D
Implement a Service Control Policy (SCP) in AWS Organizations to block stack deletion.
Show answer and explanation
Correct answer: A
Explanation
The most automated and scalable approach to ensure termination protection is enabled for all CloudFormation stacks is to use an AWS Config rule. AWS Config continuously monitors resources and can enforce compliance by flagging non-compliant stacks or automatically remediating them. Manual approaches or custom templates may work for specific cases but do not provide the same level of automation and scalability.
- A. Correct.
This is the correct option. AWS Config can be used to enforce compliance by creating a rule that checks whether termination protection is enabled for all stacks. This approach is automated and scales across multiple accounts and regions.
- B. Incorrect.
This option is incorrect because manually enabling termination protection is prone to human error and does not scale well, especially in environments with multiple stacks and accounts.
- C. Incorrect.
This option is incorrect because while a custom CloudFormation template can enforce termination protection for new stacks, it does not address existing stacks and requires manual effort for template adoption.
- D. Incorrect.
This option is incorrect because SCPs in AWS Organizations control API actions but cannot enforce stack-specific properties such as termination protection.