Restrict CodeConnections Provider and HA Regions

Why the Answer Is Correct

Option A correctly uses an SCP Deny statement with a condition that blocks any CodeConnections creation where the provider type is not the specified Git provider, effectively restricting access to only the allowed provider. Option D ensures high availability across Regions by creating a CodeConnections connection in each Region where the company operates, mitigating the risk of a single point of failure if a Region goes down. Option E leverages the CloudFormation Git sync feature by creating a CodeConnections repository link and updating the stacks to sync directly from the Git repository, fulfilling the requirement to integrate CodeConnections into the CloudFormation stacks.

Why the Other Options Are Wrong

Option B is incorrect because an Allow SCP does not restrict actions; since the OU already allows all actions, adding an Allow statement does nothing to prevent connections to other Git providers. Option C is incorrect because a single CodeConnections connection is a regional resource and creates a single point of failure, violating the high-availability requirement across Regions. Option F is incorrect because creating a CodePipeline introduces an orchestration layer rather than integrating CodeConnections directly into the CloudFormation stacks via native Git sync, which is what the question explicitly requires.

Community Comment Notes

Community members debated between using CodePipeline versus CloudFormation Git sync, with one user noting that "repository links enable CloudFormation stacks to sync directly from Git repositories" which aligns with Option E. Another user incorrectly favored Option F to create a pipeline, misunderstanding the requirement to integrate directly into the stacks. There was also confusion on SCPs, with some incorrectly assuming both Allow and Deny statements are needed, though as one commenter pointed out, "B is wrong" because Allow SCPs do not restrict access.