DOP-C02 · Question #363
A DevOps engineer deployed multiple AWS accounts by using AWS Control Tower to support different business, technical, and administrative units in a company. A security team needs the DevOps engineer…
The correct answer is C. Create individual AWS CloudFormation templates that align to a guardrail. Store the templates in. CloudFormation templates: Creating individual CloudFormation templates for each guardrail allows for version control, making it easy to review, approve, and roll back changes if necessary. AWS CodeCommit for storage: Storing the templates in AWS CodeCommit provides a robust…
Question
A DevOps engineer deployed multiple AWS accounts by using AWS Control Tower to support different business, technical, and administrative units in a company. A security team needs the DevOps engineer to automate AWS Control Tower guardrails for the company. The guardrails must be applied to all accounts in an OU of the company's organization in AWS Organizations. The security team needs a solution that has version control and can be reviewed and rolled back if necessary. The security team will maintain the management of the solution in its OU. The security team wants to limit the type of guardrails that are allowed and allow only new guardrails that are approved by the security team. Which solution will meet these requirements with the MOST operational efficiency?
Options
- ACreate individual AWS CloudFormation templates that align to a guardrail. Store the templates in
- BCreate individual AWS CloudFormation templates that align to a guardrail. Store the templates in
- CCreate individual AWS CloudFormation templates that align to a guardrail. Store the templates in
- DConfigure an AWS CodePipeline pipeline in the security team's account that an Amazon
How the community answered
(15 responses)- A7% (1)
- B13% (2)
- C60% (9)
- D20% (3)
Explanation
CloudFormation templates: Creating individual CloudFormation templates for each guardrail allows for version control, making it easy to review, approve, and roll back changes if necessary. AWS CodeCommit for storage: Storing the templates in AWS CodeCommit provides a robust version control system for managing the guardrails. AWS::ControlTower::EnableControl: Including this resource in the templates enables the speific guardrails for the targeted organizational units (OUs). AWS CodePipeline with EventBridge: Configuring a CodePipeline that triggers on changes in CodeCommit using an Amazon EventBridge rule automates the application of guardrails while allowing the security team to maintain control over the deployment process. This setup enhances operational efficiency by automating the deployment while allowing for oversight and version
Topics
Community Discussion
No community discussion yet for this question.