DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Add an AWS Lambda function as a transition action between the build and deploy stages that sends an email to the approver and waits for a response.

  Why it's wrong here

  A Lambda function added as a CodePipeline action is invoked asynchronously and the pipeline waits for that function to report a task result. A Lambda action cannot create a persistent human-approval gate because it has a hard execution timeout and no native mechanism to receive an external email response and then resume execution; waiting for a human inside the Lambda would either time out or require an external state store and a separate process to call PutJobSuccessResult. CodePipeline provides a dedicated manual approval action for exactly this purpose.

• ✗

  Create a CodeDeploy deployment group with a manual approval step in the deployment configuration.

  Why it's wrong here

  CodeDeploy deployment configurations control how traffic is shifted and how deployment failures are handled, such as rolling, blue/green, or canary strategies. They do not include any notion of a human approval step or an approver notification; manual sign-off is a CodePipeline stage/action feature that runs before a deployment, not inside the deployment group. Trying to place an approval inside CodeDeploy’s deployment configuration would be impossible and would not pause the pipeline correctly.

• ✗

  Configure an Amazon SNS topic to send an approval request email to the approver, and use a Lambda function to resume the pipeline upon approval.

  Why it's wrong here

  Using an SNS topic to email the approver is only the notification half of an approval workflow; SNS itself cannot store the approval decision or resume the pipeline. A Lambda function would need to handle the approver’s response, obtain the pipeline’s approval token (via GetPipelineState or the approved action’s job ID), and call PutApprovalResult, which duplicates the built-in approval action’s logic and adds significant custom code. CodePipeline’s native manual approval action already sends SNS notifications and exposes a secure approval API, so this bespoke Lambda+SNS path is not the recommended or correct configuration.

• ✓

  Add a manual approval action to the pipeline between the build and deploy stages, and configure the SNS topic to notify the approvers.

  Why this is correct

  Adding a manual approval action between the build and deploy stages creates a required gate that pauses pipeline execution, satisfying the constraint that only authorised personnel can approve production deployments. Configuring the SNS topic enables the pipeline to send email or SMS notifications to the designated approvers, ensuring they are alerted to review and approve the change before CodeDeploy proceeds.

Go deeper

Related to this question