How to Implement Manual Approval Actions in AWS CodePipeline
A company uses AWS CodePipeline with multiple stages. The pipeline includes a Beta stage that deploys to a test environment and a Prod stage. The team wants to require manual approval before the Prod stage. Which TWO actions should be taken to implement this? (Choose TWO.)
Quick Answer
The correct answer is to add a manual approval action in the pipeline stage between Beta and Prod, and to configure the IAM policy to grant the approver the codepipeline:PutApprovalResult permission. This works because a manual approval action pauses the pipeline at a designated stage, requiring a human to review the deployment before it proceeds to production. The IAM policy is essential because it authorizes the specific user or role to approve or reject that action, preventing unauthorized changes. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this scenario tests your understanding of pipeline stage transitions and least-privilege IAM design—a common trap is confusing CodeCommit approval rules (for pull requests) with CodePipeline manual approvals. Remember: the approval action is a stage gate, not a trigger restriction. A useful memory tip is “Stage, then Sage”—first add the approval stage, then set the IAM policy to let the sage (approver) act.
⚠ Common exam trap
Watch out — candidates often confuse manual approval actions with other approval mechanisms like CodeCommit approval rules or Lambda-based automation, but CodePipeline's manual approval is a distinct action type that requires explicit IAM permissions and a human-in-the-loop step.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Ensure that the IAM user or role performing the approval has codepipeline:PutApprovalResult permissions.
Option D is correct because AWS CodePipeline implements manual gating through a dedicated approval action: you add a manual approval action to the stage (or a stage placed between Beta and Prod) so the pipeline pauses and waits for a human decision before continuing to Prod. Option A is correct because the person or role that approves the action must call the CodePipeline PutApprovalResult API, which requires the codepipeline:PutApprovalResult IAM permission; without it, the approval cannot be submitted and the pipeline stays blocked. Option B is not needed because CloudWatch Events/EventBridge with Lambda is a custom workaround, whereas CodePipeline natively supports manual approval actions. Option C is incorrect because CodePipeline stages do not have a 'manual invocation only' setting; approvals are handled by approval actions, not stage invocation modes. Option E is incorrect because CodeCommit approval rule templates govern pull-request merges in CodeCommit, not CodePipeline stage transitions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Ensure that the IAM user or role performing the approval has codepipeline:PutApprovalResult permissions.
Why this is correct
Approving a manual approval action calls the PutApprovalResult API, so the approver's IAM identity must hold codepipeline:PutApprovalResult permission. Without it, the approval token cannot be submitted and the pipeline stalls before the Prod stage, failing the stem's requirement for a gated manual approval.
- ✗
Use CloudWatch Events to trigger a Lambda function that requires manual sign-off.
Why it's wrong here
CloudWatch Events and Lambda can automate reactions to pipeline state changes, but neither provides a native gate that halts a stage pending human sign-off. The built-in mechanism is a CodePipeline approval action placed before the Prod stage, which pauses execution until an IAM principal approves or rejects it.
- ✗
Set the Prod stage to only run on manual invocation.
Why it's wrong here
CodePipeline stages have no manual-invocation setting; stages start automatically once the preceding stage succeeds. Manual invocation describes Lambda or Step Functions execution. The requirement is a pause inside the pipeline, achieved with an approval action in the Prod stage's transition, not by disabling automatic triggering.
- ✓
Add a manual approval action in the pipeline stage between Beta and Prod.
Why this is correct
A manual approval action inserted between the Beta and Prod stages pauses the pipeline, satisfying the requirement to gate production deployments. CodePipeline halts execution until a nominated approver responds via the console or AWS CLI, so no Prod deployment proceeds without explicit human authorisation. This directly enforces the manual approval constraint before the Prod stage.
- ✗
Configure a CodeCommit approval rule template to require approval before merging.
Why it's wrong here
CodeCommit approval rule templates govern pull-request merges in the repository, not CodePipeline stage transitions. They would be the right control for enforcing peer review before code enters a branch, but the stem requires a manual gate between the Beta and Prod deployment stages, which only a pipeline approval action supplies.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps team is implementing a CI/CD pipeline using AWS CodePipeline. The pipeline has a Source stage using CodeCommit, a Build stage using CodeBuild, and a Deploy stage using CloudFormation. The team wants to add manual approval before the Deploy stage for production deployments. How should this be configured?
medium- A.Configure a CloudWatch event to send an email on build success.
- B.Use a Lambda function to approve based on build status.
- ✓ C.Add an Approval stage to the pipeline with SNS topic for notification.
- D.Create a separate pipeline for production and trigger it manually.
Why C: AWS CodePipeline natively supports Approval stages that can be configured to pause the pipeline and send a notification via an SNS topic. The SNS topic can be subscribed to by email, SMS, or other endpoints, allowing a manual approver to review the build output and then approve or reject the transition to the Deploy stage. This directly meets the requirement for a manual approval gate before production deployment without custom code or separate pipelines.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.