CloudFormation and the AWS CDK: SOA-C03 study notes and practice questions
What to know about CloudFormation and the AWS CDK for the SOA-C03 exam, from the Deployment, Provisioning, and Automation domain (22% of the exam guide), then 3 free questions to test it. Part of the SOA-C03 study guide.
CloudFormation questions ask how to change infrastructure safely and predictably.
Core ideas
A template (YAML or JSON) defines resources; a stack is one deployed copy.
Parameters make templates reusable; mappings look up values (such as per-Region settings); conditions create resources only in some cases; outputs expose values, and exports with Fn::ImportValue share them between stacks.
Nested stacks reuse common components; StackSets deploy across accounts and Regions.
Dynamic references pull values from Parameter Store or Secrets Manager at deploy time, so secrets aren’t in templates.
Safe changes
Feature
Does
Change sets
Preview what an update will add, modify or replace before running it
Stack policy
Stops updates to specific resources (such as a production database) unless overridden
DeletionPolicy
Retain or Snapshot keeps data when the resource or stack is deleted
UpdateReplacePolicy
Keeps or snapshots the old resource when an update replaces it
Termination protection
Stops the whole stack being deleted
Drift detection
Finds resources changed outside CloudFormation
Rollback triggers
Roll back an update if a CloudWatch alarm fires during it
Waiting for software
By default a resource is complete when the service says it’s running. A CreationPolicy (or WaitCondition) makes the stack wait for cfn-signal from the instance, sent after its software is installed. Use cfn-init to install packages and files from metadata.
AWS CDK
Write infrastructure in TypeScript, Python, Java and other languages; cdk synth produces CloudFormation and cdk deploy deploys it. cdk diff previews changes. The first deploy in an account and Region needs cdk bootstrap.
Common traps
Updating a property that requires replacement without a change set or DeletionPolicy, and losing data.
Stack shows CREATE_COMPLETE but the app isn’t ready. Add a creation policy and signals.
Manual changes cause drift and failed updates later.
A public library manages its catalog database, an Amazon RDS DB instance, with AWS CloudFormation.
A developer has updated the template to change the DB instance identifier and the storage type.
Before anything is applied to production, the operations team wants to see exactly which resources CloudFormation will modify and whether any will be replaced.
What should a CloudOps engineer do?
Choose one answer.
AA. Run drift detection on the stack and review which resources CloudFormation reports as modified.
BB. Create a change set from the new template and check the Replacement value for each change.
CC. Validate the new template with the ValidateTemplate API and review the list of resources it returns.
DD. Apply a stack policy that denies all updates, run the update, and read the errors for each blocked resource.
C. Wrong: Template validation checks syntax and returns parameters and capabilities. It does not compare the template with the running stack or report replacements.
Change sets let you preview a stack update. CloudFormation compares the proposed template with the current stack and lists each change, including whether a resource will be replaced, as happens when a DB instance identifier changes. Nothing is applied until the change set is executed.
A ski resort's CloudFormation stack launches an EC2 instance whose user data installs and configures the ticketing application, which takes about eight minutes.
The stack reports CREATE_COMPLETE about two minutes after launch, before the application is ready, and when the install script fails the stack still reports success.
The team wants the stack to complete only after the application is installed, and to roll back if the install fails or takes over 15 minutes.
What should a CloudOps engineer do?
Choose one answer.
AA. Add a DependsOn attribute to the instance that names the application's security group and IAM instance profile.
BB. Add a CreationPolicy with a 15-minute resource signal timeout to the instance, and run cfn-signal with the install script's exit status at the end of user data.
CC. Add an UpdatePolicy attribute with a 15-minute pause time to the instance so that CloudFormation waits before marking it complete.
DD. Add a CloudWatch alarm on the instance's status checks to the template and set the stack's rollback trigger to that alarm.
B. Right: Correct. With a CreationPolicy, CloudFormation waits for a success signal before marking the instance complete. cfn-signal reports the script's result, and a failure signal or a timeout makes the stack roll back. Learn more: CreationPolicy attribute (opens in a new tab)
By default CloudFormation marks an instance complete when EC2 reports it running, which says nothing about the software inside. A CreationPolicy makes CloudFormation wait for signals, and cfn-signal sends success or failure from user data. If no success signal arrives before the timeout, the resource fails and the stack rolls back.
B. Right: Correct. A stack policy controls which resources stack updates can change. Denying replacement and deletion of the DB instance blocks accidental changes, while other resources stay updatable. Learn more: Prevent updates to stack resources (opens in a new tab)
C. Wrong: UpdateReplacePolicy decides what happens to the old resource after a replacement, such as keeping it. The replacement still happens, and the application moves to a new, empty DB instance. Learn more: UpdateReplacePolicy attribute (opens in a new tab)
D. Right: Correct. With the Snapshot deletion policy, CloudFormation creates a snapshot of the DB instance before deleting it. The final copy remains after the stack is gone. Learn more: DeletionPolicy attribute (opens in a new tab)
Two different CloudFormation controls cover the two rules. DeletionPolicy decides what happens to a resource when the stack is deleted, and Snapshot keeps a final copy of the database. A stack policy limits what stack updates may do to specific resources. Termination protection, UpdateReplacePolicy and drift detection solve related but different problems.
Want more on CloudFormation and the AWS CDK? The 5 full-length practice sets have 13 more CloudFormation and the AWS CDK questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →