A company uses infrastructure as code (IaC) with AWS CloudFormation templates and an existing CI/CD pipeline to deploy AWS resources. After a security audit, the company wants to enforce policy as code to prevent deploying noncompliant resources (for example, an unencrypted Amazon EBS volume). Which solution will meet this requirement?
Choose an answer
Tap an option to check your answer.
Correct answer: Create rule sets with AWS CloudFormation Guard and run template validations as a stage in the CI/CD pipeline..
Why this is the answer
AWS CloudFormation Guard is an open-source policy-as-code tool specifically designed for CloudFormation templates. Integrating it into the CI/CD pipeline allows for pre-deployment validation of templates against defined policies, preventing the deployment of non-compliant resources like unencrypted EBS volumes. This proactive approach ensures compliance before resources are provisioned. AWS Config provides post-deployment compliance checks, which is reactive. AWS Trusted Advisor offers general recommendations but isn't a policy enforcement tool for IaC. SCPs are for organizational-level permissions and don't validate individual CloudFormation templates within a CI/CD pipeline.
Pass your exam — without the endless answer hunt
Get every verified question and explanation for this exam in one place, and save hours of prep. 1,000+ certifications · 20+ languages · free to start.
Pass your exam faster → No card needed