Exam AWS DevOps Engineer Professional topic 1 question 150 discussion

By default, the AWSCodeCommitPowerUser managed policy allows users to push changes to any branch in any repository in the AWS account. To restrict the developers' ability to push changes to the main branch directly, an additional policy is needed that explicitly denies these actions for the main branch. The Deny rule should be included in a policy statement that targets the specific repositories and includes a condition that references the main branch. The policy statement should look something like this: { "Effect": "Deny", "Action": [ "codecommit:GitPush", "codecommit:PutFile" ], "Resource": "arn:aws:codecommit:<region>:<account-id>:<repository-name>", "Condition": { "StringEqualsIfExists": { "codecommit:References": [ "refs/heads/main" ] } }

The correct answer is A Option C is ruled out at the outset, as it is a Managed Policy (managed by AWS) that cannot be changed.

https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit.html

C is incorrect. You can't modify managed policy

Add an additional policy

https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html

answer is A

A for me. It describes the correct approach to restrict the developers' ability to push changes directly to the main branch in AWS CodeCommit. The company can create an additional policy that includes a Deny rule for the GitPush and PutFile actions for the specific repositories and with a condition that references the main branch. This will restrict the developers from pushing changes directly to the main branch.

https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html - Other developers can still pull from the branch, make their own branches, and create pull requests, but they cannot push or merge changes to that branch. You can configure this access by creating a conditional policy that uses a context key for one or more branches in IAM. https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit.html - AWS managed policies cannot be edited

A is the right answer. We need to add a new policy that denies action to push to the repository 's main branch. C is incorrect because you cannot modify a managed IAM policy.

A for me. Managed policy can not be modified

https://docs.aws.amazon.com/codecommit/latest/userguide/how-to-conditional-branch.html

C for me