A city mandates that all new networking and IAM baselines be deployed from a CI pipeline using infrastructure as code, not console click-ops. Which approach best meets that change-control requirement?
Select an answer to reveal the explanation.
Short Explanation
Click-ops is how two accounts quietly diverge. Put the network and IAM blueprint in CloudFormation and let the pipeline stamp it the same way every time—auditable, repeatable, and reviewable.
Full Explanation
Municipal change control for networking and IAM baselines depends on repeatable, reviewable deployments rather than interactive console drift. Defining VPC, subnet, route, and IAM role patterns in CloudFormation (or equivalent infrastructure as code) and promoting those templates through a CI pipeline gives auditors a versioned artifact, peer review, and the same stamp in every target account. Console-only creation optimizes for individual speed but produces snowflake accounts that diverge silently and cannot be rebuilt from source. Whiteboard photos and manual recreation fail reproducibility and leave no trustworthy history of what actually shipped. Blanket AdministratorAccess removes the very guardrails change management is trying to impose and invites unmanaged privilege growth. Exam caveat: IaC alone does not stop console edits—pair pipelines with SCPs, permission boundaries, or change windows that deny divergent manual mutations in production OUs. Operational check: run the baseline pipeline into a non-production account, diff stack resources against the template, attempt a forbidden console VPC change under the intended SCP, and confirm CloudTrail shows the pipeline role as the deployer of record.