Secure Manual Approval in CodePipeline
An organization has a AWS CodePipeline that deploys a critical application. The pipeline uses a manual approval step before deploying to production. The team wants to ensure that only authorized users can approve the deployment, and that the approval action is logged for compliance. Which combination of actions should the team take? (Select TWO.)
Quick Answer
The answer is to enable AWS CloudTrail for auditing and configure the Lambda function for approval to check IAM tags. This combination ensures that only users with a specific IAM tag, such as 'role=approver', can invoke the approval API, providing fine-grained authorization, while CloudTrail captures all approval API calls for compliance logging. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of securing manual approval pipelines in CodePipeline, specifically how to enforce authorization at the API level rather than relying on notification services like SNS, which lack granular control. A common trap is choosing CloudWatch Logs for API logging, but remember that CloudTrail is the dedicated service for recording API activity across AWS. Memory tip: think "Tag and Trail" — IAM tags for who can approve, CloudTrail for what was done.
⚠ Common exam trap
A common mix-up: candidates confuse CloudWatch Logs (for monitoring) with CloudTrail (for auditing), or mistakenly think CodeCommit can manage pipeline permissions, when in fact CodePipeline's approval actions require IAM-based or Lambda-based authorization, not repository policies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the approval action to invoke an AWS Lambda function that validates the approver's IAM role tags.
AWS CodePipeline's manual approval action can be configured to invoke an AWS Lambda function that checks the approver's IAM role tags, ensuring only authorized users (e.g., those with a specific 'approver' tag) can approve. This provides fine-grained, custom authorization beyond basic IAM policies. Option B is correct because enabling AWS CloudTrail captures all approval API calls (e.g., PutApprovalResult) as audit logs, meeting compliance requirements for tracking who approved and when.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure the approval action to invoke an AWS Lambda function that validates the approver's IAM role tags.
Why this is correct
This allows custom authorization based on tags.
- ✓
Enable AWS CloudTrail to log all approval API calls for auditing.
Why this is correct
CloudTrail logs all API calls, including approval actions.
- ✗
Use Amazon Simple Notification Service (SNS) to send approval notifications and allow any subscriber to approve.
Why it's wrong here
SNS does not enforce authorization.
- ✗
Use AWS CodeCommit to manage approval permissions via repository policies.
Why it's wrong here
CodeCommit permissions are for source code, not pipeline approvals.
- ✗
Store approval logs in Amazon CloudWatch Logs for real-time monitoring.
Why it's wrong here
CloudWatch Logs is for log storage, not API auditing.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 251-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company uses AWS CodePipeline to deploy a critical application. The pipeline has a manual approval step before deployment. Which TWO actions should be taken to improve security and auditability? (Choose two.)
hard- ✓ A.Enable AWS CloudTrail to log all approval actions.
- B.Remove the approval step and rely on post-deployment monitoring.
- ✓ C.Integrate with AWS IAM to require multi-factor authentication (MFA) for approvers.
- D.Replace the manual approval with an automated approval based on test results.
- E.Use a shared IAM user for all approvers to simplify management.
Why A: Enabling AWS CloudTrail to log all approval actions provides a detailed, immutable audit trail of who approved or rejected a pipeline stage, when it happened, and from which IP address. This is essential for compliance and forensic analysis, as CloudTrail captures the `Approval` API calls made by CodePipeline, including the `approve` and `reject` actions, along with the IAM user or role identity. Without CloudTrail, there is no native logging of manual approval events, making it impossible to prove accountability.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.