DOP-C02 · Question #416
A company manages environments for its application in multiple AWS accounts. Each environment account is in a different OU in AWS Organizations. A DevOps team is responsible for the application…
The correct answer is A. Update the DevOps group to have the ReadOnlyAccess permission set for the production. Chosen option provides the most operationally efficient solution by: - Restricting the DevOps team to read-only access in production, ensuring only the pipeline can perform deployments. - Giving the DevOps engineer an AdministratorAccess permission set with the ability to…
Question
A company manages environments for its application in multiple AWS accounts. Each environment account is in a different OU in AWS Organizations. A DevOps team is responsible for the application deployment process across the environments. The deployment process uses an AWS CodePipeline pipeline in a Shared Services account. The DevOps team members are in the same user group. The team members have administrative access to all accounts through AWS IAM Identity Center. A recent deployment problem in the development environment required the DevOps team to perform manual steps. The deployment to the production environment then resulted in an incident that caused the pipeline to fail, which blocked new deployments for several hours. A DevOps engineer needs to ensure that only the pipeline can perform deployments in the production environment. The DevOps engineer must have access to the environment in case of an emergency. Which solution will meet these requirements with the MOST operational efficiency?
Options
- AUpdate the DevOps group to have the ReadOnlyAccess permission set for the production
- BCreate an SCP that denies all write actions for the DevOps team members on the production OU.
- CUpdate the DevOps group to be able to assume the pipeline role for the production accounts.
- DCreate an SCP that denies all write actions for the DevOps team members on the production OU.
How the community answered
(29 responses)- A72% (21)
- B17% (5)
- C7% (2)
- D3% (1)
Explanation
Chosen option provides the most operationally efficient solution by: - Restricting the DevOps team to read-only access in production, ensuring only the pipeline can perform deployments. - Giving the DevOps engineer an AdministratorAccess permission set with the ability to assume the pipeline role, allowing emergency intervention. - Applying an SCP to the production OU that denies modification of resources by any entity other than the pipeline role, enforcing the deployment restriction at the organizational level.
Topics
Community Discussion
No community discussion yet for this question.