DOP-C02 practice question: CloudFormation templates, change sets and stack updates (1 of 2)

Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

An online retailer manages its order-history database with an AWS CloudFormation stack. The stack includes a DynamoDB table whose partition key is about to change, and the team knows that a key change forces CloudFormation to replace the table, deleting its data.

The team needs to keep normal stack updates running, such as changes to the Lambda functions and IAM roles in the same stack, while making sure that no update can replace or delete the table without a deliberate decision.

The change must be enforced by CloudFormation itself, and it should not depend on each engineer remembering to review a change set.

Which approach meets these requirements?

Choose one answer.

A. Attach a stack policy that denies the Update:Replace and Update:Delete actions on the table's logical ID, and allows all other updates to the stack.
B. Turn on termination protection for the stack, so that no one can delete it, and rely on change set reviews to catch any update that would replace the table.
C. Set the table's DeletionPolicy to Retain, so that the old table is kept if CloudFormation replaces it, and then update the key during a change window.
D. Add an IAM policy to the deployment role that denies the dynamodb:DeleteTable action, so that any replacement of the table fails when the stack tries to remove the old table.

Show the answer and explanation

Answer: A

A. Right: Correct. A stack policy is enforced by CloudFormation for every update, and a deny on Update:Replace stops a key change from replacing the table. Updates to the functions and roles remain allowed. Learn more: Prevent updates to stack resources (opens in a new tab)
B. Wrong: Termination protection only blocks deleting the whole stack. It does not stop an update from replacing a resource, and it depends on reviewers to catch the replacement. Learn more: Protect CloudFormation stacks from being deleted (opens in a new tab)
C. Wrong: Retain keeps the old table after a replacement, but the replacement still happens and the application loses its live table. The data would then need a manual migration, which the team wanted to avoid. Learn more: DeletionPolicy attribute (opens in a new tab)
D. Wrong: CloudFormation creates the replacement table first and deletes the old one only during cleanup, so this deny does not stop the replacement. The stack would point at a new, empty table while the old one is left behind.

Explanation

A stack policy is evaluated by CloudFormation on every update, so it can deny the replacement or deletion of one resource while other updates proceed. Termination protection, a retain policy and a permission deny each either protect a different action or depend on people to notice the replacement.

DOP-C02 practice question: CloudFormation templates, change sets and stack updates (1 of 2)

Explanation

Study

Keep practicing