SCS-C02 Question 447
Select 3Your company has adopted Infrastructure as Code (IaC) using AWS CloudFormation to ensure a secure and consistent deployment strategy for cloud resources. During periodic reviews, your security team identifies that some developers are making unauthorized changes to deployed resources, bypassing the CloudFormation templates. What steps should you take to enforce secure and consistent deployments using AWS-native services?
- A
Enable AWS Config rules to detect and remediate resource changes that are not compliant with CloudFormation stacks.
- B
Use AWS CloudTrail to monitor API calls and alert on changes made outside of CloudFormation.
- C
Set up service control policies (SCPs) in AWS Organizations to restrict unauthorized actions on resources.
- D
Enable StackSets to deploy CloudFormation stacks across multiple accounts and Regions.
- E
Use AWS Systems Manager State Manager to enforce desired configurations on resources.
Show answer and explanation
Correct answers: A, B, C
Explanation
To implement a secure and consistent deployment strategy, it is critical to enforce compliance with IaC templates like CloudFormation. AWS Config can detect non-compliant changes, AWS CloudTrail provides visibility into unauthorized modifications, and SCPs can enforce policies to restrict unauthorized actions. Together, these services ensure secure and consistent deployments while preventing changes outside of CloudFormation. StackSets and State Manager, while valuable in other contexts, do not directly address the issue of unauthorized changes in this scenario.
- A. Correct.
Correct: AWS Config can track changes to resources and ensure compliance with CloudFormation templates through rules and remediation actions.
- B. Correct.
Correct: AWS CloudTrail helps monitor API calls, providing visibility into unauthorized changes made outside of CloudFormation.
- C. Correct.
Correct: Service control policies (SCPs) in AWS Organizations can be used to restrict certain actions, preventing unauthorized modifications.
- D. Incorrect.
Incorrect: StackSets are used for deploying CloudFormation stacks across multiple accounts and Regions but do not directly address unauthorized resource changes.
- E. Incorrect.
Incorrect: AWS Systems Manager State Manager enforces configuration compliance but is not directly tied to CloudFormation or unauthorized changes.