A company uses AWS Organizations to manage multiple AWS accounts. The company needs a solution to improve the company's management of AWS resources in a production account. The company wants to use AW

Question

Options

• AConfigure the CloudFormation infrastructure as code (IaC) generator to scan for existing
• BConfigure AWS Config to scan for existing resources in the AWS account. Create a
• CUse CodeConnections to establish a connection between the Git provider and AWS
• DUse CodeConnections to establish a connection between the Git provider and CloudFormation.
• ECreate an IAM role, and set CloudFormation as the principal. Grant the IAM role access to
• FCreate an IAM role, and set CloudFormation as the principal. Grant the IAM role access to

• A
  59% (16)
• B
  4% (1)
• D
  22% (6)
• F
  15% (4)

Explanation

Step A: Using a tool like CloudFormation resource import or IaC generator to scan and create a template from existing resources is efficient to bring current infrastructure under management. Step C: Using CodeConnections (AWS's solution to connect Git repositories) with AWS CodePipeline ensures any changes to CloudFormation templates in the Git repo automatically deploy infrastructure changes, enforcing infrastructure as code workflows. Step E: Creating an IAM role with CloudFormation as the principal ensures CloudFormation has permissions to manage resources. Using an SCP to deny all actions except by this role enforces strict control, preventing manual changes outside the pipeline. Option B uses AWS Config which is more for compliance and auditing, not direct resource import. Option D is invalid because CloudFormation does not natively sync with Git; CodePipeline does. Option F is less secure than denying all except the IAM role.

No community discussion yet for this question.