Before applying infrastructure changes for a library catalog service to the test account, CI should show what will change. Which CDK practice supports that review?
Select an answer to reveal the explanation.
Short Explanation
Diff is the highlighter on the renovation contract—see the redlines before swinging the hammer. CI cdk diff against test shows the plan. Deploying blind and diffing afterward is backwards.
Full Explanation
Before applying infrastructure changes for a library catalog service to the test account, CI should run cdk diff against the test environment so reviewers see intended infrastructure changes before deploy. Diffing synthesized CDK against the target environment is part of automated checks around deployment testing and prevents surprise resource replacements in municipal catalog stacks. Preview first, deploy second—especially when tables, DNS, or IAM may be replaced.
Deploying first, then running cdk diff only if something breaks in test fails because the damage window already opened and citizens' catalog data may already be at risk. Disabling diff output because CloudFormation change sets are never useful for developers fails conceptually—diffs and change sets are exactly how developers review IaC impact. Applying changes with the AWS console and keeping the CDK app for documentation screenshots only fails by abandoning the IaC source of truth.
Exam caveat: diffs can show replacements for rename-like changes—reviewers must understand when a replace means downtime or data loss for catalog tables. Operational check: require a CI artifact attaching cdk diff output to the change ticket, reject deploys without review sign-off, then apply the reviewed change set to test.