Restrict CodeConnections Provider and HA Regions

DOP-C02 By islever Editorial Last updated

Deploy automation to create, onboard, and secure AWS accounts in a multi-account or multi-Region environment. Implement deployment strategies for instance, container, and serverless environments.

Short answer

ADE Deny non-specified Git providers via SCP, create CodeConnections in each Region for HA, and use repository links for CloudFormation Git sync.

Question

A company uses AWS Organizations to manage multiple AWS accounts. The accounts are in an OU that has a policy attached to allow all actions. The company is migrating several Git repositories to a specified AWS CodeConnections supported Git provider. The Git repositories manage AWS CloudFormation stacks for application infrastructure that the company deploys across multiple AWS Regions.
The company wants a DevOps team to integrate CodeConnections into the CloudFormation stacks. The DevOps team must ensure that company staff members can integrate only with the specified Git provider. The deployment process must be highly available across Regions.
Which combination of steps will meet these requirements? (Choose three.)
  1. Add a new SCP statement to the OU that denies the CodeConnections CreatingConnections action where the provider type is not the specified Git provider. Correct Answer
  2. Add a new SCP statement to the OU that allows the CodeConnections CreatingConnections action where the provider type is the specified Git provider.
  3. Use CodeConnectlons to configure a single CodeConnections connection to each Git repository.
  4. Use CodeConnections to create a CodeConnections connection from each Region where the company operates to each Git repository. Correct Answer
  5. Use CodeConnections to create a CodeConnections repository link. Update each CfoudFormation stack to sync from the Git repository. Correct Answer
  6. For each Git repository, create a pipeline in AWS CodePipefine that has the Git repository set as the source and a CloudFormation deployment stage.

Key Takeaways

The question tests restricting AWS CodeConnections via SCPs and achieving cross-Region high availability using regional connections and CloudFormation repository links.

This guide explains how to restrict AWS CodeConnections to a specific Git provider using SCPs and ensure high availability across Regions by creating regional connections and using CloudFormation Git sync.

Common mistake: Choosing a single CodeConnections connection (Option C) instead of per-Region connections (Option D) for high availability, or using an Allow SCP (Option B) instead of a Deny SCP (Option A).

Expert Analysis

Why the Answer Is Correct

Option A correctly uses an SCP Deny statement with a condition that blocks any CodeConnections creation where the provider type is not the specified Git provider, effectively restricting access to only the allowed provider. Option D ensures high availability across Regions by creating a CodeConnections connection in each Region where the company operates, mitigating the risk of a single point of failure if a Region goes down. Option E leverages the CloudFormation Git sync feature by creating a CodeConnections repository link and updating the stacks to sync directly from the Git repository, fulfilling the requirement to integrate CodeConnections into the CloudFormation stacks.

Why the Other Options Are Wrong

Option B is incorrect because an Allow SCP does not restrict actions; since the OU already allows all actions, adding an Allow statement does nothing to prevent connections to other Git providers. Option C is incorrect because a single CodeConnections connection is a regional resource and creates a single point of failure, violating the high-availability requirement across Regions. Option F is incorrect because creating a CodePipeline introduces an orchestration layer rather than integrating CodeConnections directly into the CloudFormation stacks via native Git sync, which is what the question explicitly requires.

Community Comment Notes

Community members debated between using CodePipeline versus CloudFormation Git sync, with one user noting that "repository links enable CloudFormation stacks to sync directly from Git repositories" which aligns with Option E. Another user incorrectly favored Option F to create a pipeline, misunderstanding the requirement to integrate directly into the stacks. There was also confusion on SCPs, with some incorrectly assuming both Allow and Deny statements are needed, though as one commenter pointed out, "B is wrong" because Allow SCPs do not restrict access.

Official Reference

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/git-sync.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

For high availability of regional services like CodeConnections, always provision the resource in every operating Region rather than relying on a single Region. To restrict a specific action or resource type in AWS Organizations when an Allow policy already exists, use a Deny SCP with a StringNotEquals condition.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. 4145ad0 👍 4
    this is the answer
  2. siloft 👍 3
    A - SCP deny policy ensures only the specified Git provider can be used (strongest enforcement) D - Regional connections in each operating Region provide high availability (if one Region fails, others continue working independently) E - Repository links enable CloudFormation stacks to sync directly from Git repositories (direct integration as required)
  3. 052cedf 👍 2
    A → Enforce Git provider restriction Use SCP in AWS Organizations Deny all except specified provider D → Multi-region high availability Create CodeConnections per Region Ensures resilience Using: AWS CodeConnections F → Deployment pipeline AWS CodePipeline Git → CloudFormation deployment
  4. GiorgioGss 👍 1
    Step 1: Restrict access to the Git provider To ensure staff cannot create connections to any other Git provider, we need an SCP that denies connections to any provider other than the specified one. ✅ Option A ✅ Step 2: Allow connections to the specified provider We also need to explicitly allow creating connections for the specified provider. ✅ Option B ✅ Step 3: Create the connections in a highly available way CodeConnections connections are regional resources. To make deployments highly available across Regions, you must create a connection in each Region where deployments occur. ✅ Option D ✅
  5. ryuhei 👍 1
    Correct choices: A, C, F If you need further clarification or examples (e.g., CodePipeline configuration or CloudFormation StackSets setup), please let me know!
Show 3 more comments
  1. danish1234 👍 1
    ADF make sense since we want region availbility
  2. ryuhei 👍 1
    Grok answer
  3. 4145ad0 👍 1
    B is wrong.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Optimizing Amazon Timestream Query Performance

S-grade

Deploy the CloudWatch agent as a StatefulSet with IRSA and CloudWatchAgentServerPolicy, and configure the OIDC provider

S-grade

Disable cross-zone load balancing on the target group and start an Application Recovery Controller zonal shift

S-grade

Stream all CloudWatch metrics to Firehose, transform with Lambda, and deliver to S3

S-grade

Practice All DOP-C02 Questions

Access 85 questions with complete answers and detailed explanations.

View Full DOP-C02 Practice Test →

← Back to DOP-C02 Study Guide