A company uses AWS Control Tower to deploy multiple AWS accounts. A security team must automate Control Tower guardrails applied to all accounts in an OU, with version control and rollback…

The correct answer is C. Store CloudFormation templates per guardrail in a Git repo. Use CodePipeline in the security. Using CodePipeline + CodeConnections Git repo provides version control, automated deployment, and rollback. Each template includes AWS::ControlTower::EnableControl for OU- level guardrails. AWS Control Tower documentation recommends this GitOps automation model.

Submitted by andreas_gr· Mar 6, 2026Configuration Management and Infrastructure as Code

Question

A company uses AWS Control Tower to deploy multiple AWS accounts. A security team must automate Control Tower guardrails applied to all accounts in an OU, with version control and rollback capabilities. Which solution meets these requirements?

Options

ACreate CloudFormation templates per guardrail stored in CodeCommit. Use
BSame as A but for each account.
CStore CloudFormation templates per guardrail in a Git repo. Use CodePipeline in the security
DStore templates in S3 and trigger deployment with EventBridge PutObject.

How the community answered

(42 responses)

A
7% (3)
B
2% (1)
C
76% (32)
D
14% (6)

Explanation

Using CodePipeline + CodeConnections Git repo provides version control, automated deployment, and rollback. Each template includes AWS::ControlTower::EnableControl for OU- level guardrails. AWS Control Tower documentation recommends this GitOps automation model.

Topics

#AWS Control Tower#AWS Organizations#IaC#Guardrails

Community Discussion

No community discussion yet for this question.

Full DOP-C02 Practice