MENU
A company uses AWS Organizations to manage multiple AWS accounts. The company needs a solution to improve the company's management of AWS resources in a production account.
The company wants to use AWS CloudFormation to manage all manually created infrastructure. The company must have the ability to strictly control who can make manual changes to AWS infrastructure. The solution must ensure that users can deploy new infrastructure only by making changes to a CloudFormation template that is stored in an AWS CodeConnections compatible Git provider.
Which combination of steps will meet these requirements with the LEAST implementation effort? (Select THREE).
Step A: Using a tool like CloudFormation resource import or IaC generator to scan and create a template from existing resources is efficient to bring current infrastructure under management.
Step C: Using CodeConnections (AWS's solution to connect Git repositories) with AWS CodePipeline ensures any changes to CloudFormation templates in the Git repo automatically deploy infrastructure changes, enforcing infrastructure as code workflows.
Step E: Creating an IAM role with CloudFormation as the principal ensures CloudFormation has permissions to manage resources. Using an SCP to deny all actions except by this role enforces strict control, preventing manual changes outside the pipeline.
Option B uses AWS Config which is more for compliance and auditing, not direct resource import. Option D is invalid because CloudFormation does not natively sync with Git; CodePipeline does. Option F is less secure than denying all except the IAM role.
AWS CloudFormation Resource Import:
'Import existing resources into CloudFormation stacks for management.'
(CloudFormation Resource Import)
AWS CodePipeline and CodeConnections Integration:
'Use CodeConnections to connect Git providers with AWS CodePipeline for continuous deployment.'
(AWS CodePipeline Git Integration)
AWS Organizations SCP and IAM Role Best Practices:
'Use SCPs to restrict actions and IAM roles with limited principals to enforce secure management.'
(AWS Organizations Best Practices)