A security team's stack creates a customer managed AWS KMS key and its alias.
Five application stacks in the same account and Region each need the key's ARN. The team does not want the ARN typed into any template, and CloudFormation must refuse to delete the key stack while any application stack still uses the ARN.
What should the developer do?
Choose one answer.
AA. Copy the key ARN into a Mappings section of each of the five application templates.
BB. Nest the key template inside each application stack using AWS::CloudFormation::Stack.
CC. Use Fn::GetAtt in each application template, naming the key stack and its logical ID.
DD. Export the key ARN as an output, and import it with Fn::ImportValue in each stack.
Show the answer and explanation
Answer: D
A. Wrong: Mappings fix values inside each template, so the ARN is typed into five places and goes stale if the key is replaced. CloudFormation also records no link between the stacks, so it cannot block a delete of the key stack.
B. Wrong: Each nested stack creates its own key, so the application stacks would not share one key and one ARN. Nesting keeps the resources inside a parent stack, so there is no shared value for other stacks to import.
C. Wrong: Fn::GetAtt reads an attribute of a resource in the same template, so it cannot reach a resource in another stack. The template would fail to resolve the reference.
Cross-stack references let one stack export an output value that other stacks in the same account and Region import with Fn::ImportValue. CloudFormation does not allow the exporting stack to be deleted, or its exported value changed, while another stack still imports it. Mappings copy the value into each template, and nested stacks belong to one parent stack, so neither gives a shared, protected value.
Want more on AWS SAM, CloudFormation and CDK? The 5 full-length practice sets have 15 more AWS SAM, CloudFormation and CDK questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →