AWS SAM, CloudFormation and CDK: DVA-C03 study notes and practice questions
What to know about AWS SAM, CloudFormation and CDK for the DVA-C03 exam, from the Testing and Deployment domain (22% of the exam guide), then 3 free questions to test it. Part of the DVA-C03 study guide.
These questions test how a template is written, previewed and changed, not how to memorize every resource property.
SAM templates
A SAM template is a CloudFormation template with a Transform: AWS::Serverless-2016-10-31 line. Resource types such as AWS::Serverless::Function, AWS::Serverless::Api and AWS::Serverless::HttpApi are expanded into standard resources.
Globals set shared properties, such as Runtime, Timeout and environment variables, for every function in the template. A single function can override a global value.
sam build prepares the code and dependencies, and sam deploy uploads artifacts to S3 and creates a change set. sam validate checks the template.
CloudFormation essentials
A change set shows what will be added, modified, or replaced before anything changes. Use it before a production update.
Drift detection finds resources changed outside the template.
A stack policy blocks updates to named resources, such as a production database.
DeletionPolicy and UpdateReplacePolicy decide whether a resource is kept when the stack is deleted or replaced. Use Retain or Snapshot for data stores.
Rollback triggers monitor CloudWatch alarms during a stack operation and roll back if one goes into alarm.
Share values across stacks with stack outputs and Fn::ImportValue, or with SSM parameter references that the template resolves at deploy time.
CDK
The CDK defines infrastructure in a programming language with constructs. cdk synth produces the CloudFormation template, and cdk diff compares it with the deployed stack.
cdk bootstrap creates the staging resources, such as the asset bucket, that deployments need in an account and Region.
Unit tests can assert on the synthesized template, and the exam treats these as part of the testing skills.
How to choose
Scenario wording
Answer
Shorten a template for many serverless functions with the same settings
SAM Globals
See what an update will change before running it
Change set or cdk diff
Stop an update from replacing or changing a production resource
Stack policy
Keep a table or its data when the stack is deleted
DeletionPolicyRetain or Snapshot
Find a resource changed in the console
Drift detection
Let stacks in one account read a shared KMS key ARN without typing it
Stack output and Fn::ImportValue, or an SSM parameter reference
Write infrastructure in TypeScript or Python
CDK
Roll back automatically when an alarm fires during a deploy
Rollback triggers
Common traps
Editing the template and expecting an in-place change. Some properties force a replacement, which creates a new resource and deletes the old one.
Hardcoding an ARN in a second template when the value could be exported or read from SSM.
Using Retain on a stateless resource, which leaves orphans, or leaving the default on a database that must survive stack deletion.
Running sam local as a deployment step. It runs code on your machine and deploys nothing.
A developer maintains an AWS SAM template with twelve AWS::Serverless::Function resources.
Every function repeats the same Runtime and Timeout, and the same LOG_LEVEL environment variable. One function needs a longer Timeout than the others. The developer wants to declare the shared settings once and still allow that exception.
What should the developer do?
Choose one answer.
AA. Move the shared settings to a Globals section under the Function key, and set the longer Timeout on that one function.
BB. Move the shared settings to the Parameters section and reference them from each function with Ref.
CC. Move the shared settings to the Mappings section and read them in every function with Fn::FindInMap.
DD. Move the shared settings to the Outputs section so that each function can import them with Fn::ImportValue.
Show the answer and explanation
Answer: A
A. Right: Correct. Globals settings are inherited by every function of that type, and a value set on a resource replaces the global one for scalar properties such as Timeout. Environment variables are merged, so LOG_LEVEL stays shared. Learn more: SAM Globals section (opens in a new tab)
B. Wrong: Parameters hold values supplied at deploy time, but each function would still have to reference them, so the repetition stays. They are not a way to apply properties to many resources at once.
C. Wrong: Mappings are lookup tables, and every function would still need its own Fn::FindInMap lines. This reduces the values repeated but not the repeated declarations.
D. Wrong: Outputs publish values from a stack, usually for other stacks. They do not apply properties to resources in the same template.
Explanation
The SAM Globals section declares properties once for all resources of a type. A property set on a single resource overrides the global value for scalars like Timeout, and maps like environment variables are merged. Parameters, Mappings and Outputs still need a reference in every function.
A CloudFormation stack manages a production Amazon RDS DB instance.
A developer has edited several properties of the DB instance in the template. Before anything in production is touched, the developer wants to know whether CloudFormation would replace the database, and still wants to be able to approve the change afterwards.
What should the developer do?
Choose one answer.
AA. Run drift detection on the stack and read the property differences that it reports for the DB instance.
BB. Create a change set from the edited template and review the Replacement value for the DB instance before executing it.
CC. Call ValidateTemplate on the edited template and read the response for any resources it would replace.
DD. Update the stack with rollback disabled, and inspect the DB instance if the update fails part-way through.
Show the answer and explanation
Answer: B
A. Wrong: Drift detection compares the live resources with the template that the stack currently uses. It says nothing about how an edited template would be applied, so it cannot predict a replacement.
B. Right: Correct. A change set previews the changes to a stack without making them, including whether each resource would be replaced. The developer can then execute the change set to apply it or delete it to discard it. Learn more: Updating stacks using change sets (opens in a new tab)
C. Wrong: ValidateTemplate checks that the template is syntactically valid and lists its parameters. It does not compare the template with the running stack, so it cannot show a replacement.
D. Wrong: This applies the change to production instead of previewing it. A replacement would already have started by the time the developer could look.
Explanation
A change set previews how an updated template would change a stack, including which resources are modified or replaced, without making any changes. The developer can then execute or discard it. Drift detection, template validation and a live update do not give a pre-change replacement preview.
A security team's stack creates a customer managed AWS KMS key and its alias.
Five application stacks in the same account and Region each need the key's ARN. The team does not want the ARN typed into any template, and CloudFormation must refuse to delete the key stack while any application stack still uses the ARN.
What should the developer do?
Choose one answer.
AA. Copy the key ARN into a Mappings section of each of the five application templates.
BB. Nest the key template inside each application stack using AWS::CloudFormation::Stack.
CC. Use Fn::GetAtt in each application template, naming the key stack and its logical ID.
DD. Export the key ARN as an output, and import it with Fn::ImportValue in each stack.
Show the answer and explanation
Answer: D
A. Wrong: Mappings fix values inside each template, so the ARN is typed into five places and goes stale if the key is replaced. CloudFormation also records no link between the stacks, so it cannot block a delete of the key stack.
B. Wrong: Each nested stack creates its own key, so the application stacks would not share one key and one ARN. Nesting keeps the resources inside a parent stack, so there is no shared value for other stacks to import.
C. Wrong: Fn::GetAtt reads an attribute of a resource in the same template, so it cannot reach a resource in another stack. The template would fail to resolve the reference.
Cross-stack references let one stack export an output value that other stacks in the same account and Region import with Fn::ImportValue. CloudFormation does not allow the exporting stack to be deleted, or its exported value changed, while another stack still imports it. Mappings copy the value into each template, and nested stacks belong to one parent stack, so neither gives a shared, protected value.
Want more on AWS SAM, CloudFormation and CDK? The 5 full-length practice sets have 15 more AWS SAM, CloudFormation and CDK questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →