DOP-C02 Question 96
Select 3Your organization has adopted Infrastructure as Code (IaC) using AWS CloudFormation to provision and manage infrastructure. A recent audit revealed that changes to CloudFormation templates are being directly deployed to production without proper review, leading to outages. You have been tasked with implementing a change management process to mitigate this risk. Which combination of steps would ensure a robust and automated change management process for IaC while minimizing risks?
- A
Implement a CI/CD pipeline that validates CloudFormation templates for syntax errors and compliance before deploying changes.
- B
Enable AWS Config rules to monitor and automatically remediate any unexpected infrastructure changes in production.
- C
Require all CloudFormation template changes to be reviewed via a pull request process in a version control system like AWS CodeCommit or GitHub.
- D
Deploy changes directly to production from developer workstations to speed up the deployment process.
- E
Set up a change approval workflow using AWS CodePipeline and integrate it with AWS Service Catalog for production deployments.
Show answer and explanation
Correct answers: A, C, E
Explanation
To establish a robust change management process for IaC, you should implement a CI/CD pipeline to validate changes, enforce a pull request process for code reviews, and introduce an approval workflow. These steps ensure that changes are properly reviewed, validated, and approved before deployment, reducing the risk of errors and outages in production environments. While AWS Config rules are useful for monitoring and remediation, they do not replace the need for a structured review and approval process.
- A. Correct.
Correct: Implementing a CI/CD pipeline ensures that changes are validated for template syntax and compliance before deployment, reducing the risk of errors in production.
- B. Incorrect.
Partially correct but not sufficient alone: AWS Config rules help monitor and remediate infrastructure drift, but they don’t address the need for a structured review and approval process for template changes.
- C. Correct.
Correct: Using a pull request process enforces code review for CloudFormation template changes, ensuring that changes are reviewed and approved before deployment.
- D. Incorrect.
Incorrect: Deploying directly from developer workstations bypasses any validation, review, or approval processes, increasing the risk of errors and outages.
- E. Correct.
Correct: A change approval workflow with AWS CodePipeline and AWS Service Catalog ensures that only approved changes are deployed to production, adding an additional layer of governance.