DOP-C02 SDLC Automation Practice Question
A team uses AWS CodePipeline to deploy a containerized application to Amazon ECS. The pipeline uses a source stage from CodeCommit, a build stage that builds a Docker image and pushes it to Amazon ECR, and a deploy stage that updates an ECS service. The team wants to add a manual approval step before the deploy stage to allow QA to verify the image. What is the BEST way to implement this?
⚠ Common exam trap
The trap here is that candidates often over-engineer a solution by introducing custom polling, Lambda functions, or external triggers, when AWS CodePipeline already provides a fully managed, native manual approval action that handles pausing, notification, and resumption without any custom code.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Add a manual approval stage in CodePipeline between the build and deploy stages, and configure SNS to notify approvers.
CodePipeline natively supports manual approval actions that pause the pipeline at a specified stage and wait for an approver to manually approve or reject the transition. By adding a manual approval stage between the build and deploy stages, the pipeline will automatically halt after the build completes, and you can configure Amazon SNS to notify the QA team via email or other endpoints when their approval is required. This approach requires no custom infrastructure, integrates directly with the pipeline's state machine, and provides a built-in audit trail of approvals.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Configure an AWS Lambda function in the pipeline that checks a DynamoDB table for approval status and pauses until approved.
Why it's wrong here
An AWS Lambda function invoked as part of a pipeline stage can only return success or failure synchronously; it cannot suspend the pipeline's execution indefinitely to wait for an external approval. You could build a custom polling worker that queries a DynamoDB table for an approval flag, but that would require complex state management and re-invocations without leveraging CodePipeline's native pause-and-resume semantics. The built-in approval action is designed exactly for this gate, whereas a Lambda/DynamoDB approach is a brittle approximation that adds latency and operational overhead.
- ✗
Use an Amazon SNS topic to send a notification to QA, and have them manually trigger the deploy stage by clicking a link in the email.
Why it's wrong here
An SNS topic only delivers notifications to subscribers; it contains no intrinsic mechanism to authorize a stage transition or to signal CodePipeline to resume. Having QA click a link in an email would require an HTTP endpoint to receive the click and an API call to update pipeline state, which SNS alone cannot provide. CodePipeline's manual approval action automatically handles the pause and resume, and SNS is just the notification transport, not the approval mechanism. Without the native approval action, this approach cannot block the deploy stage or record an auditable approval decision.
- ✗
Use Amazon CloudWatch Events to trigger a custom action that waits for an approval signal.
Why it's wrong here
CloudWatch Events are designed for reacting to events and triggering actions, not for directly implementing a blocking manual approval *within* a CodePipeline stage. While it could trigger a custom notification or process, it lacks the native capability to pause CodePipeline's execution flow for an explicit approval decision. This option is tempting as CloudWatch Events are excellent for event-driven automation, such as notifying a team when a pipeline stage fails or an image is pushed to ECR, but not for an integrated approval gate.
- ✓
Add a manual approval stage in CodePipeline between the build and deploy stages, and configure SNS to notify approvers.
Why this is correct
The native CodePipeline manual approval action is the correct pattern: it creates a gate that pauses the pipeline after the build stage and does not proceed to deploy until an approved or rejected decision is recorded. When you add the action, you configure an SNS topic for notifications, and approvers with the proper IAM policy respond through the console or CLI with `put-approval-result`. This integrated workflow provides explicit audit trails and automatically resumes only on approval, which is far more reliable than any external workaround. It is purpose-built to block stage transitions and supports both email SNS notifications and custom SNS topics for team alerting.
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.