SAP-C03 practice question: Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager) (1 of 2)
Operational Excellence and Automation A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A bank's platform team deploys infrastructure with CloudFormation templates written by 25 product teams. A recent template created an S3 bucket that used the default SSE-S3 encryption instead of the required customer managed KMS key, and the security team wants that class of mistake blocked before any resource is created, not found afterwards.
Some teams also deploy with the AWS CDK, and the control must cover every stack in every account. The security team also wants a regular check that resources have not drifted from their approved settings.
Which solution meets these requirements?
Choose one answer.
AA. Create an AWS Config rule that flags S3 buckets whose default encryption does not use a customer managed KMS key, and enable automatic remediation that sets the required key on each bucket the rule finds.
BB. Write a CDK aspect that checks every S3 bucket in the synthesized templates, and require all 25 teams to run their CDK apps through a shared pipeline that enforces the aspect.
CC. Create a CloudFormation Hook that fails the creation of S3 buckets whose default encryption does not use a customer managed KMS key, activate it in every account and Region, and run drift detection on a schedule.
DD. Add an SCP that denies s3:CreateBucket for every principal in the organization, and have teams request each bucket from the security team through a ticket.
Show the answer and explanation
Answer: C
A. Wrong: The rule and remediation act after the bucket exists, which is the step the security team wants to move earlier. The bucket would exist briefly without encryption, and the rule does not check the template before deployment.
B. Wrong: The aspect covers CDK apps only, and the teams that deploy raw CloudFormation templates would not be checked. The security team needs the control to cover every stack.
C. Right: Correct. A CloudFormation Hook runs during deployment and fails the operation before the bucket is created, and it applies to stacks however they were authored, including CDK output. Scheduled drift detection finds resources changed after deployment.
D. Wrong: The deny blocks all buckets, which stops the teams' work instead of enforcing the encryption setting. The option also replaces the control with a manual request process.
Explanation
A CloudFormation Hook blocks non-compliant resources during deployment for every stack, including those synthesized by the CDK, and drift detection finds later changes. Config remediation acts after creation, CDK aspects miss raw templates, and a blanket SCP blocks legitimate buckets.
Want more on Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager)? The 5 full-length practice sets have 6 more Policy as code and secrets in IaC (Hooks, CDK aspects, Secrets Manager) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →