DOP-C02 Question 98
Select 2Your organization is developing an Infrastructure as Code (IaC)-based platform using AWS CloudFormation. To ensure safe and auditable deployments, you need to implement a change management process that prevents unauthorized changes and ensures that any updates are reviewed before deployment. Which combination of steps should you take to achieve this? (Select TWO.)
- A
Use AWS CloudFormation StackSets with Service-Managed permissions to enforce central control over deployments.
- B
Enable and configure AWS CloudFormation Change Sets to preview changes before applying them to the stack.
- C
Store CloudFormation templates in an Amazon S3 bucket and enable bucket versioning for auditability.
- D
Implement a Git-based workflow with pull requests and code reviews for template changes.
- E
Use AWS Config rules to monitor changes to CloudFormation stacks and automatically rollback unauthorized changes.
Show answer and explanation
Correct answers: B, D
Explanation
To implement an effective change management process for IaC-based platforms, it is critical to ensure that changes are reviewed and approved before deployment. AWS CloudFormation Change Sets provide a mechanism to preview changes to the infrastructure, while a Git-based workflow with pull requests ensures that all changes to the IaC templates are reviewed and authorized. Together, these steps form a robust process for managing and auditing changes in an IaC environment.
- A. Incorrect.
While AWS CloudFormation StackSets with Service-Managed permissions help enforce centralized control over multiple accounts, it does not directly address the need for change management or review of stack updates.
- B. Correct.
AWS CloudFormation Change Sets allow you to preview changes before deploying them, ensuring that any updates are reviewed and applied safely. This is a critical component of a change management process.
- C. Incorrect.
Storing templates in an S3 bucket with versioning provides basic auditability but does not enforce review or prevent unauthorized changes.
- D. Correct.
Using a Git-based workflow with pull requests and code reviews ensures that all template changes are reviewed by team members before deployment, which is a key component of a robust change management process.
- E. Incorrect.
AWS Config rules are valuable for monitoring compliance and detecting drift, but they do not inherently enforce a change review process or prevent unauthorized changes.