DOP-C02 practice question: Custom resources, helper scripts and stack policies
Configuration Management and IaC A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A hospital network deploys a CloudFormation stack that includes a custom resource. An AWS Lambda function behind the custom resource creates a database parameter group that the clinical reporting database needs.
After a recent change, stack creation hung for an hour and then failed with a timeout on the custom resource, even though the parameter group existed in the account. The Lambda function returned normally, but an exception in a helper path skipped the code that reports back to CloudFormation.
The operations team wants any future failure in the custom resource to end the stack operation quickly and report the reason, instead of making CloudFormation wait for its timeout.
Which change meets these requirements?
Choose one answer.
AA. Increase the custom resource's ServiceTimeout to the maximum allowed value, so that the stack waits longer and the function has more time to finish its work.
BB. Wrap the handler so that every event, including exceptions, sends a SUCCESS or FAILED response with the reason to the pre-signed response URL that CloudFormation supplies.
CC. Move the parameter group out of the template and create it with a CloudFormation StackSet, so that the custom resource no longer runs in the stack's account.
DD. Add a CreationPolicy with a count of one to the custom resource, so that CloudFormation waits for a signal from the function and fails the resource when the signal is missing.
Show the answer and explanation
Answer: B
A. Wrong: A longer timeout makes the stack wait longer before it fails, which is the opposite of the goal. The function still would not report back when an exception skips the response code.
B. Right: Correct. CloudFormation waits for a response to the pre-signed URL in each custom resource event, so a handler that always responds lets the stack fail fast with the reason. The stack then rolls back promptly, and the error text appears in the events. Learn more: Create custom provisioning logic with custom resources (opens in a new tab)
D. Wrong: CreationPolicy applies to EC2 instances and Auto Scaling groups that send cfn-signal messages. It is not the mechanism for a custom resource's response, so it does not fix the hang. Learn more: CreationPolicy attribute (opens in a new tab)
Explanation
A custom resource is complete only when its handler sends a response to the pre-signed URL that CloudFormation provides. A handler that responds with SUCCESS or FAILED on every path lets the stack fail quickly and show the reason. Longer timeouts, StackSets and creation policies do not address the missing response.
Want more on Custom resources, helper scripts and stack policies? The 5 full-length practice sets have 7 more Custom resources, helper scripts and stack policies questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →