SCS-C02 Question 445
Select 3Your organization uses AWS CloudFormation templates to provision infrastructure resources across multiple environments (e.g., development, staging, production). As part of your security strategy, you need to ensure the deployments are secure, parameters such as credentials are not exposed, and changes to the infrastructure are reviewed before being applied. Which combination of actions should you take to implement a secure and consistent deployment strategy?
- A
Use AWS Secrets Manager to securely manage sensitive parameters like database credentials and reference them in your CloudFormation templates.
- B
Enable AWS CloudTrail to log all CloudFormation API calls and review changes made to the infrastructure.
- C
Implement change sets in CloudFormation to preview changes before applying updates to the stack.
- D
Store CloudFormation templates in an S3 bucket with public read access to allow collaboration across teams.
- E
Use AWS CodePipeline with manual approval actions for deploying CloudFormation stacks to production.
Show answer and explanation
Correct answers: A, C, E
Explanation
To implement a secure and consistent deployment strategy, you should use AWS Secrets Manager to securely manage sensitive information, CloudFormation change sets to preview and validate changes before deployment, and AWS CodePipeline with manual approvals to enforce a controlled and consistent deployment process. Logging with CloudTrail is useful but does not directly secure or standardize deployments, and public S3 access to templates is a security risk.
- A. Correct.
Correct: AWS Secrets Manager securely manages sensitive parameters such as database credentials, ensuring they are not hardcoded in CloudFormation templates.
- B. Incorrect.
Incorrect: While AWS CloudTrail is useful for logging API calls, it does not directly contribute to securing or making deployments consistent. It is more about auditing.
- C. Correct.
Correct: CloudFormation change sets allow you to preview changes to your stack before applying them, ensuring unintended changes are avoided.
- D. Incorrect.
Incorrect: Storing CloudFormation templates in an S3 bucket with public read access exposes them to unauthorized access, violating security best practices.
- E. Correct.
Correct: AWS CodePipeline can help enforce a consistent deployment process, and manual approval actions add an additional security layer before deploying to production.