DVA-C02 Question 284
Select 2You are working on an AWS Lambda-based application that uses a Git-based CI/CD pipeline for deployment. The pipeline fetches code from a Git repository hosted on AWS CodeCommit. Your team wants to ensure that only approved changes are merged into the main branch. How can you achieve this using Git-based version control tools?
- A
Enable branch protection rules on the main branch and require pull request approvals before merging.
- B
Use a pre-merge hook in AWS CodeCommit to automatically reject unapproved changes.
- C
Set up a custom pipeline stage that validates commits using AWS Lambda before merging.
- D
Require developers to use signed commits and configure the repository to reject unsigned commits.
- E
Enable auto-merge for all pull requests to streamline the deployment process.
Show answer and explanation
Correct answers: A, D
Explanation
To ensure only approved changes are merged into the main branch, you can use branch protection rules to enforce pull request approvals and require signed commits. These are standard Git-based practices that integrate seamlessly with AWS CodeCommit and help maintain repository security and integrity.
- A. Correct.
This is correct because branch protection rules and requiring pull request approvals are standard Git-based practices to ensure only approved changes are merged.
- B. Incorrect.
AWS CodeCommit does not natively support pre-merge hooks. Pre-merge hooks are a local Git feature and cannot be enforced centrally at the repository level.
- C. Incorrect.
While a custom pipeline stage could validate changes, this approach would require significant customization and is not a best practice for managing Git repositories.
- D. Correct.
This is correct because requiring signed commits ensures that the commits are made by verified authors, adding an additional layer of security to the repository.
- E. Incorrect.
This is incorrect because enabling auto-merge removes manual review processes, which goes against the goal of ensuring only approved changes are merged.