SCS-C02 Question 453
Select 3Your organization uses AWS CloudFormation to deploy infrastructure as code (IaC). As part of a security review, you are tasked with ensuring the templates are hardened and that any drift in deployed resources is detected and addressed. Which of the following are the best practices to achieve this?
- A
Use AWS CloudFormation Drift Detection to identify resource changes that were made outside of the template.
- B
Store AWS CloudFormation templates in a version-controlled repository such as AWS CodeCommit or Git.
- C
Avoid using resource policies in the AWS CloudFormation templates to reduce potential misconfigurations.
- D
Implement least privilege for IAM roles and users that execute CloudFormation stacks.
- E
Ensure parameters with sensitive data such as passwords are stored in plain text within the CloudFormation template for transparency.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure secure deployment with AWS CloudFormation, it is essential to detect and address drift using Drift Detection, maintain proper version control for templates, and enforce least privilege for IAM roles. Avoiding resource policies or storing sensitive data in plain text introduces security risks and is not recommended. These best practices help maintain the integrity and security of infrastructure deployed as code.
- A. Correct.
Using AWS CloudFormation Drift Detection helps identify any changes made to resources outside of the CloudFormation stack, ensuring consistency and compliance with the defined infrastructure as code.
- B. Correct.
Storing templates in a version-controlled repository ensures that any changes to infrastructure are tracked, auditable, and can be reviewed for security implications.
- C. Incorrect.
Avoiding resource policies is not a best practice. Resource policies can be used securely to define permissions and access control at the resource level. The key is to implement them securely, not to avoid them.
- D. Correct.
Implementing least privilege for IAM roles and users ensures that only authorized personnel or systems can create, update, or delete CloudFormation stacks, reducing the risk of unauthorized changes.
- E. Incorrect.
Storing sensitive data in plain text within the template is a security risk. Parameters with sensitive data should use secure mechanisms such as AWS Secrets Manager or AWS Systems Manager Parameter Store.