DOP-C02 · Question #174
A company manages AWS accounts for application teams in AWS Control Tower. Individual application teams are responsible for securing their respective AWS accounts. A DevOps engineer needs to enable Am
The correct answer is A. Create a CloudFormation custom resource that invokes an AWS Lambda function. Configure the. https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/enable-amazon-guardduty- conditionally-by-using-aws-cloudformation-templates.html
Question
A company manages AWS accounts for application teams in AWS Control Tower. Individual application teams are responsible for securing their respective AWS accounts. A DevOps engineer needs to enable Amazon GuardDuty for all AWS accounts in which the application teams have not already enabled GuardDuty. The DevOps engineer is using AWS CloudFormation StackSets from the AWS Control Tower management account. How should the DevOps engineer configure the CloudFormation template to prevent failure during the StackSets deployment?
Options
- ACreate a CloudFormation custom resource that invokes an AWS Lambda function. Configure the
- BUse the Conditions section of the CloudFormation template to enable GuardDuty in accounts
- CUse the CloudFormation Fn::GetAtt intrinsic function to check whether GuardDuty is already
- DManually discover the list of AWS account IDs where GuardDuty is not enabled. Use the
How the community answered
(45 responses)- A56% (25)
- B24% (11)
- C13% (6)
- D7% (3)
Explanation
https://docs.aws.amazon.com/prescriptive-guidance/latest/patterns/enable-amazon-guardduty- conditionally-by-using-aws-cloudformation-templates.html
Topics
Community Discussion
No community discussion yet for this question.