What combination best supports auditable changes and rapid rollback across multiple AWS accounts?

• A. Manual change approvals with no automation
• B. Relying on ad-hoc changes
• C. CloudWatch alarms providing rollback triggers only
• D. Infrastructure as Code with versioned templates and a change-control process integrated with CI/CD

Answer: (D)

Auditable changes and rapid rollback across many AWS accounts come from treating infrastructure as code and tying deployments to a versioned template within a formal change-control process in CI/CD. With Infrastructure as Code, every change is captured as code in a version control system, producing a traceable history of who changed what and when, along with the rationale in pull requests or commit messages. Because the templates are versioned, you can identify and revert to a known-good state by redeploying a previous version, which provides rapid rollback across all accounts.

Integrating this with a CI/CD pipeline adds automated validation, testing, and approval gates before any change is applied. This ensures consistency across accounts, reduces drift, and maintains an auditable trail of every rollout. Centralized pipelines can deploy the same templates to multiple accounts with parameterization to adapt to each environment, while maintaining a single source of truth.

In contrast, approaches that rely on manual approvals with no automation, ad-hoc changes, or reactive rollback triggers alone lack the repeatability, traceability, and cross-account consistency needed for scalable governance. They either don’t provide a dependable rollback path to a specific prior state or fail to maintain an auditable history across many accounts.