Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 180 discussion

C and E are correct: A: Cloudwatch Logs is to store logs from AWS resources like EC2, not codepipeline B: We dont need to store codepipeline actions in S3. C: We need to monitor users'actions, so using cloudtrail to store logs to S3 is the recommended one D: We should not invoke AWS lambda for approval E: This is the recommended one

CloudTrail tracks API activity in your AWS environment, but it does not specifically capture manual approval actions within CodePipeline. CloudTrail can help you audit changes to resources but is not suited for tracking the specific approval process within CodePipeline itself.

https://docs.aws.amazon.com/codepipeline/latest/userguide/monitoring-cloudtrail-logs.html

ans ce

C- Logging, since Cloudwatch Logs and writelogs to S3 can not capture the Approval that only CloudTrail can E - Manual Approval Step is natively supported by codepipeline, no need to make it more complex with anything

C- Logging E - Manual Approval Step

https://stelligent.com/2019/06/11/aws-codepipeline-approval-gate-tracking/

C and E: The approval process is an AWS API Event and this is managed by CloudTrail https://docs.aws.amazon.com/codepipeline/latest/userguide/incident-response.html

CE: AWS CodePipeline is integrated with AWS CloudTrail, a service that provides a record of actions taken by a user, role, or an AWS service in CodePipeline;. CloudTrail captures all API calls for CodePipeline as events. The calls captured include calls from the CodePipeline console and code calls to the CodePipeline API operations. If you create a trail, you can enable continuous delivery of CloudTrail events to an Amazon S3 bucket, including events for CodePipeline. If you don't configure a trail, you can still view the most recent events in the CloudTrail console in Event history. Using the information collected by CloudTrail, you can determine the request that was made to CodePipeline, the IP address from which the request was made, who made the request, when it was made, and additional details. https://docs.aws.amazon.com/codepipeline/latest/userguide/monitoring-cloudtrail-logs.html

C. because actions performed by the security team are api calls. And api calls go into CloudTrail, if you want to retain them we have to send them into an S3 bucket. https://docs.aws.amazon.com/codepipeline/latest/userguide/monitoring-cloudtrail-logs.html

E is for Manual Approval A is for recorded and retained

D and E is correct