DVA-C02 Deployment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create a CloudWatch Events rule to trigger a Lambda function that waits for approval.

  Why it's wrong here

  Creating a CloudWatch Events rule to trigger a Lambda function that waits for approval is not the native mechanism for adding a manual gate in CodePipeline. EventBridge (formerly CloudWatch Events) can only observe state changes, not pause the pipeline's execution, and a Lambda function would have to call the CodePipeline API to attempt to mimic approval, which requires managing approval tokens and lacks the built-in IAM permissions and state transition handling. This approach is over-engineered, error-prone, and does not provide a controlled pause in the pipeline's stage flow, making it incorrect.

• ✓

  Add a manual approval action in the CodePipeline pipeline.

  Why this is correct

  Adding a manual approval action in the CodePipeline pipeline is the standard and correct way to introduce a human approval gate. When the pipeline reaches this action, it automatically pauses and waits for an authorized user to approve or reject via the AWS Management Console, CLI, or SDK (using the ApproveManualApproval or RejectManualApproval APIs). This native action supports IAM-based access control, optional SNS notifications, and an auditable approval history, and it integrates directly with the pipeline's state machine.

• ✓

  Configure the approval action to require a specified IAM user or group to approve.

  Why this is correct

  Configuring the approval action to require a specified IAM user or group is a correct and important security best practice. While the manual approval action itself is a built-in CodePipeline feature, you must attach an IAM policy that grants only the intended principals the codepipeline:ApproveManualApproval (and optionally codepipeline:RejectManualApproval) permission on that specific pipeline. Without this configuration, any user with general CodePipeline permissions could potentially approve or reject the action, so specifying IAM principals ensures a who, what, and when audit trail and enforces separation of duties.

• ✗

  Use a CodeDeploy lifecycle hook to pause the deployment.

  Why it's wrong here

  Using a CodeDeploy lifecycle hook to pause the deployment is incorrect because CodeDeploy lifecycle events are designed for automated, scripted tasks such as running tests, backing up data, or validating health checks—they cannot create an interactive human approval gate. A lifecycle hook can only fail or succeed, which either stops the deployment or lets it continue, but it has no built-in mechanism to wait for a person to approve or reject. Since manual sign-off requires stateful, auditable approval, this does not meet the requirement; CodeDeploy hooks are not a substitute for CodePipeline's manual approval action.

• ✗

  Configure an SNS topic to send an email to the approver.

  Why it's wrong here

  Configuring an SNS topic to send an email to the approver is a common auxiliary step, but it is not an approval mechanism by itself. While you can attach the SNS topic to a manual approval action so that the designated approver receives a notification when approval is pending, the SNS topic does not pause the pipeline, capture the approving user's decision, or store an approval history. The actual approval must be recorded through the CodePipeline approval API or console; SNS is a notification channel only, not a gate, so this alone is incorrect.

Go deeper

Related to this question