DOP-C02 Question 99
Select 3Your organization uses Infrastructure as Code (IaC) to manage its cloud infrastructure on AWS. As part of the change management process, you must ensure that updates to infrastructure definitions are reviewed, validated, and deployed with minimal risk of introducing errors. Which practices should you implement to meet these requirements?
- A
Use a Git-based workflow with pull requests to review infrastructure changes before merging.
- B
Manually apply infrastructure changes directly in the AWS Management Console to expedite deployment.
- C
Implement automated linting and static code analysis tools for IaC templates as part of the CI/CD pipeline.
- D
Use AWS CloudFormation Change Sets to preview the impact of changes before deployment.
- E
Skip testing infrastructure changes in non-production environments to accelerate updates.
Show answer and explanation
Correct answers: A, C, D
Explanation
Effective change management for IaC-based platforms involves leveraging version control systems, automated validation tools, and preview mechanisms to ensure changes are reviewed, validated, and tested before deployment. Git-based workflows, automated linting, and AWS CloudFormation Change Sets collectively enforce these principles, minimizing the risk of errors while maintaining traceability and consistency. Avoiding manual interventions and skipping testing are counterproductive and contradict AWS best practices for DevOps.
- A. Correct.
Using a Git-based workflow with pull requests ensures that all infrastructure changes are reviewed by peers before being merged. This helps identify potential issues early and enforces best practices in the change management process.
- B. Incorrect.
Manually applying changes in the AWS Management Console bypasses the IaC-based workflow, introducing risks such as configuration drift, lack of version control, and reduced traceability.
- C. Correct.
Automated linting and static code analysis tools can detect syntax errors, policy violations, and other issues in IaC templates before changes are deployed, reducing the risk of errors.
- D. Correct.
AWS CloudFormation Change Sets provide a mechanism to review the proposed changes to the infrastructure before actual deployment, ensuring visibility into the impact of changes.
- E. Incorrect.
Skipping testing in non-production environments increases the risk of deploying untested and potentially faulty infrastructure changes to production, which is against best practices.