DOP-C02 · Question #362
A company is using AWS CloudFormation to perform deployments of its application environment. A deployment failed during a recent update to the existing CloudFormation stack. A DevOps engineer discover
The correct answer is A. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps lead. AWS Config managed rule: The CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK managed rule automatically detects drift (manual changes) in CloudFormation stacks, which directly addresses the need to detect manual modifications of resources. Amazon SNS for alerts: By creating an SNS top
Question
A company is using AWS CloudFormation to perform deployments of its application environment. A deployment failed during a recent update to the existing CloudFormation stack. A DevOps engineer discovered that some resources in the stack were manually modified. The DevOps engineer needs a solution that detects manual modification of resources and sends an alert to the DevOps lead. Which solution will meet these requirements with the LEAST operational effort?
Options
- ACreate an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps lead
- BTag all CloudFormation resources with a specific tag. Create an AWS Config custom rule by
- CCreate an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the DevOps lead
- DCreate an AWS Config managed rule that has the
How the community answered
(33 responses)- A79% (26)
- B12% (4)
- C6% (2)
- D3% (1)
Explanation
AWS Config managed rule: The CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK managed rule automatically detects drift (manual changes) in CloudFormation stacks, which directly addresses the need to detect manual modifications of resources. Amazon SNS for alerts: By creating an SNS topic and subscribing the DevOps lead to it, you can easily send notifications when drift is detected. EventBridge for triggering notifications: Setting up an EventBridge rule that triggers on the NON_COMPLIANT status from the AWS Config rule allows for automated alerting without the need for custom logic or additional resources.
Topics
Community Discussion
No community discussion yet for this question.