Troubleshooting deployments: SOA-C03 study notes and practice questions
What to know about Troubleshooting deployments for the SOA-C03 exam, from the Deployment, Provisioning, and Automation domain (22% of the exam guide), then 2 free questions to test it. Part of the SOA-C03 study guide.
These questions describe a failed deployment and ask what went wrong or how to recover.
CloudFormation states
State
Meaning and fix
CREATE_FAILED → ROLLBACK_COMPLETE
A resource failed during creation. Read the first failed event in the stack events; delete the stack and create it again after fixing
UPDATE_ROLLBACK_FAILED
The rollback couldn’t restore a resource, often because it was changed or deleted outside CloudFormation. Fix the resource by hand, or ContinueUpdateRollback and skip resources that can’t be rolled back
DELETE_FAILED
A resource can’t be deleted (such as a non-empty S3 bucket or a security group in use). Empty or detach it, or retain it
Turn off rollback (preserve successfully provisioned resources) while debugging so you can inspect what failed.
Common causes
Error
Fix
Access denied / not authorized
The user or CloudFormation service role lacks permissions; check SCPs and permissions boundaries too
Limit exceeded
Request a Service Quotas increase
Insufficient free addresses in subnet
Add subnets with free IP ranges or a secondary CIDR; subnets can’t be resized
InsufficientInstanceCapacity
Try other AZs or instance types, or reserve capacity
Invalid AMI ID or key pair
AMIs and key pairs are regional; use the right Region or copy them
Resource already exists
A name is hard-coded and taken; let CloudFormation generate names
Timeout waiting for signal
The instance couldn’t run cfn-signal: no internet or endpoint access, script error, or wrong count
EC2 launch problems
Instance stuck pending then terminated: EBS snapshot or KMS key permission problems, or an instance store AMI issue.
Can’t connect: security group, route, key pair, or the instance failed its status checks.
Use EC2 serial console or EC2Rescue for an instance that won’t boot.
Common traps
Reading the last error instead of the first one in stack events.
Retrying without fixing drift behind UPDATE_ROLLBACK_FAILED.
A logistics broker's Auto Scaling group spans two private /26 subnets.
During a peak-season scale-out, the group's activity history shows failed launches with the message that there are not enough free addresses in the subnet. Other workloads also use these subnets, and the account has plenty of remaining EC2 vCPU quota.
What should a CloudOps engineer do to allow the group to scale?
Choose one answer.
AA. Request an increase to the EC2 On-Demand vCPU quota so that the group can launch more instances in the Region.
BB. Edit the two subnets and change their CIDR blocks from /26 to /22 so that they contain more IP addresses.
CC. Add a secondary CIDR block to the VPC, create larger subnets from it, and add them to the group.
DD. Change the launch template to a larger instance type so that fewer instances are needed to serve the same load.
C. Right: Correct. A /26 subnet has only 59 usable addresses because AWS reserves five. A secondary CIDR provides room for larger subnets, and adding them to the group gives it addresses to launch into. Learn more: VPC CIDR blocks (opens in a new tab)
Launch failures that mention free addresses mean the subnets have run out of IP addresses. Subnet CIDR blocks cannot be resized, so the fix is new subnets, from spare VPC space or a secondary CIDR block, added to the group. Quotas and instance types do not create addresses.
An esports league's CloudFormation stack update failed, and the stack then entered UPDATE_ROLLBACK_FAILED.
The events show that the rollback could not restore an Amazon SQS queue because an engineer had deleted the queue manually earlier that day. The queue is no longer needed.
The other stack resources, including a DynamoDB table with live data, must be kept, and the team wants the stack updatable again.
What should a CloudOps engineer do?
Choose one answer.
AA. Continue the update rollback and skip the queue's logical ID so that the rollback can finish.
BB. Delete the stack and create it again from the last working template, then restore the table's data from a backup.
CC. Cancel the stack update so that CloudFormation stops the rollback and returns the stack to UPDATE_COMPLETE.
DD. Run drift detection on the stack so that CloudFormation records the deleted queue as drifted and finishes the rollback.
Show the answer and explanation
Answer: A
A. Right: Correct. Continue update rollback retries the rollback, and resources to skip lets CloudFormation treat resources that cannot be rolled back as done. The stack reaches UPDATE_ROLLBACK_COMPLETE and can be updated again. Learn more: Continue rolling back an update (opens in a new tab)
UPDATE_ROLLBACK_FAILED usually means a resource changed outside CloudFormation and cannot be returned to its old state. ContinueUpdateRollback retries the rollback, and its resources-to-skip option handles resources that no longer exist. The stack then returns to a stable state without touching the other resources.
Want more on Troubleshooting deployments? The 5 full-length practice sets have 11 more Troubleshooting deployments questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →