DOP-C02 SDLC Automation Practice Question
A company has a CI/CD pipeline that deploys to Amazon ECS using AWS CodePipeline. The pipeline includes a manual approval step before deployment to production. The security team requires that all approvals be logged in AWS CloudTrail and that the approver's identity be verified. Which action should the DevOps engineer take to meet these requirements?
⚠ Common exam trap
Candidates often think they need to create a custom CloudTrail trail or enable Insights to meet logging requirements, but CloudTrail already logs all CodePipeline API calls by default, including manual approval actions with the approver's identity.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that the manual approval action is configured as a CodePipeline approval action; CloudTrail will log the 'Approval' event with the IAM user ARN.
CodePipeline's manual approval action inherently generates an 'Approval' event in CloudTrail when an approver approves or rejects the action. This event includes the IAM user ARN of the approver, satisfying both the logging and identity verification requirements without additional configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure that the manual approval action is configured as a CodePipeline approval action; CloudTrail will log the 'Approval' event with the IAM user ARN.
Why this is correct
CodePipeline's manual approval action generates a PutApprovalResult API call when an approver clicks to approve or reject. CloudTrail automatically captures that call, and the event includes the IAM principal ARN (user or role), the timestamp, source IP, and session context. This satisfies the audit requirement without any additional configuration.
- ✗
Create a custom CloudTrail trail specifically for CodePipeline API calls.
Why it's wrong here
CloudTrail already records all CodePipeline API calls, including PutApprovalResult, in the account's default trail. Creating a dedicated CloudTrail trail solely for CodePipeline does not expand the set of events logged; it only changes the delivery destination (e.g., a different S3 bucket or CloudWatch Logs). The problem is not missing API logging, but correctly correlating the approval event with the IAM user ARN, which the default trail already provides.
- ✗
Enable CloudTrail Insights to detect unusual approval activity.
Why it's wrong here
CloudTrail Insights performs anomaly detection on API activity and would flag unusual patterns like a sudden spike in approvals, but it is not designed to log discrete approval events nor does it capture the specific IAM user ARN for each approval. Insights also has an additional cost and requires a separate trail to be enabled. For a precise audit trail of who approved an action, you need the standard CloudTrail event history.
- ✗
Configure the approval action to send a notification to an Amazon SNS topic, and log the SNS delivery to CloudWatch Logs.
Why it's wrong here
An SNS notification on an approval action merely fires an email or message about the action; it does not record the identity of the approver. Even if you configure SNS delivery to CloudWatch Logs via a CloudWatch Events rule, the log payload would only include the message from SNS, not the IAM user ARN from the PutApprovalResult API call. The audit compliance requirement is met by CloudTrail, not by the notification mechanism.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,013-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.