SAP-C02 Question 163
Single answerYour company uses AWS CloudFormation templates to manage its infrastructure. Recently, a new requirement was introduced to ensure that all Amazon S3 buckets created via these templates have default encryption enabled. How can you enforce this requirement while allowing developers to write their own CloudFormation templates?
- A
Use a CloudFormation macro to automatically modify templates and add encryption settings to S3 buckets.
- B
Enable AWS Config rules to detect non-compliant S3 buckets and remediate them automatically.
- C
Implement CloudFormation StackSets with a governance policy that enforces encryption settings.
- D
Use AWS CloudFormation Guard to validate that S3 bucket encryption is configured correctly in templates.
Show answer and explanation
Correct answer: D
Explanation
AWS CloudFormation Guard is a policy-as-code tool specifically designed to validate CloudFormation templates against a set of predefined rules. By using it, developers can ensure compliance with organizational policies, such as enforcing encryption on S3 buckets, before deploying resources. Other options either focus on post-deployment compliance or are not designed for template validation.
- A. Incorrect.
This option is incorrect because CloudFormation macros are used to transform or customize templates dynamically but do not enforce compliance for existing templates.
- B. Incorrect.
While AWS Config can detect non-compliant S3 buckets, it operates after resources are deployed and does not validate templates before deployment.
- C. Incorrect.
CloudFormation StackSets are used for managing stacks across multiple accounts and regions but do not enforce template compliance directly.
- D. Correct.
AWS CloudFormation Guard is the correct choice as it allows you to define rules to validate CloudFormation templates, ensuring that S3 bucket encryption settings are present before deployment.