Exam AWS Certified SysOps Administrator - Associate topic 1 question 424 discussion

Exam question from Amazon's AWS Certified SysOps Administrator - Associate

Question #: 424
Topic #: 1

[All AWS Certified SysOps Administrator - Associate Questions]

A company uses AWS CloudFormation to deploy its application infrastructure. Recently, a user accidentally changed a property of a database in a CloudFormation template and performed a stack update that caused an interruption to the application. A SysOps administrator must determine how to modify the deployment process to allow the DevOps team to continue to deploy the infrastructure, but prevent against accidental modifications to specific resources.

Which solution will meet these requirements?

A. Set up an AWS Config rule to alert based on changes to any CloudFormation stack. An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation.
B. Set up an Amazon EventBridge event with a rule to initiate based on any CloudFormation API call. An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation.
C. Launch the CloudFormation templates using a stack policy with an explicit allow for all resources and an explicit deny of the protected resources with an action of Update:*.
D. Attach an IAM policy to the DevOps team role that prevents a CloudFormation stack from updating, with a condition based on the specific Amazon Resource Names (ARNs) of the protected resources.

Show Suggested Answer

Suggested Answer: C 🗳️

by mpl203 at March 21, 2024, 1:12 a.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

mpl203

Highly Voted 9 months ago

Selected Answer: C

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html

upvoted 5 times

...

klayytech

Highly Voted 8 months, 4 weeks ago

Selected Answer: C

Stack Policy: Define a stack policy for the CloudFormation stack containing your application infrastructure. In the policy, use an explicit Deny statement for any update actions (Update*) on the specific resources you want to protect (e.g., critical databases, security groups).

upvoted 5 times

...