SCS-C02 Question 452
Select 3You are tasked with deploying an AWS CloudFormation template that provisions critical resources, including an Amazon S3 bucket, an IAM role, and an Amazon RDS instance. To ensure security best practices, you want to prevent unauthorized changes to the infrastructure and minimize potential vulnerabilities. Which actions should you take during deployment and maintenance?
- A
Enable drift detection after deployment to monitor unauthorized infrastructure changes.
- B
Use parameter store or AWS Secrets Manager to manage sensitive information like database credentials instead of hardcoding them in the template.
- C
Grant the CloudFormation execution role full administrator permissions to avoid deployment failures.
- D
Define resource policies, such as bucket policies or security group rules, explicitly in the CloudFormation template.
- E
Turn off rollback on failure to inspect partially created resources for debugging purposes.
Show answer and explanation
Correct answers: A, B, D
Explanation
To follow deployment best practices with AWS CloudFormation, you should enable drift detection to monitor for unauthorized changes, use secure methods like AWS Secrets Manager to manage sensitive data, and explicitly define security policies in the template. These steps help ensure that the infrastructure is secure, compliant, and operates as intended. Avoid granting excessive permissions to the CloudFormation execution role and turning off rollbacks, as these actions can introduce security risks.
- A. Correct.
Correct. Enabling drift detection after deployment allows you to monitor for unauthorized changes to infrastructure, ensuring consistency with the CloudFormation template.
- B. Correct.
Correct. Sensitive information should never be hardcoded in CloudFormation templates. Using AWS Secrets Manager or Parameter Store enhances security by securely managing credentials.
- C. Incorrect.
Incorrect. Granting the CloudFormation execution role full administrator permissions is not a security best practice. The role should follow the principle of least privilege.
- D. Correct.
Correct. Defining resource policies explicitly in the template ensures that security configurations like access controls are applied consistently and are not left to default or manual configurations.
- E. Incorrect.
Incorrect. Turning off rollback on failure is not a best practice for security. Partially created resources could expose vulnerabilities or lead to misconfigurations.