Exam AWS Certified DevOps Engineer - Professional DOP-C02 topic 1 question 347 discussion

AWS Config Managed Rule (CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK): The CLOUDFORMATION_STACK_DRIFT_DETECTION_CHECK is a built-in AWS Config rule that automatically detects drift on resources managed by CloudFormation. Drift refers to manual changes made to CloudFormation-managed resources, and this rule identifies such changes. EventBridge Rule: You can create an EventBridge rule that listens for NON_COMPLIANT events triggered by the AWS Config rule when drift is detected. This will ensure that whenever there are manual modifications on CloudFormation-managed resources, the event will be captured. SNS Notification: Using Amazon SNS, you can set up an email notification for the DevOps lead whenever the event is triggered. Subscribing the DevOps lead to the SNS topic ensures that they are immediately notified without requiring manual intervention.

Key Requirements: 1. Detect manual modification of CloudFormation-managed resources. 2. Send an alert to the DevOps lead when such changes are detected. 3. Achieve this with minimal operational effort.

Least operational overhead always will involve using AWS-Managed services instead of developing code, for example. So, A in my opinion.

A is less complex by just using SNS for notifying, instead of creating a lambda function just to do that.

Option D is the most efficient and least operationally complex solution because it uses AWS Config’s drift detection rule, integrates with EventBridge for event handling, and leverages a Lambda function to send notifications. This approach directly addresses the need to detect manual changes in CloudFormation-managed resources and alert the DevOps lead.