AWS CDK and AWS SAM: DOP-C02 study notes and practice questions
What to know about AWS CDK and AWS SAM for the DOP-C02 exam, from the Configuration Management and IaC domain (17% of the exam guide), then 1 free question to test it. Part of the DOP-C02 study guide.
These questions ask which IaC tool fits a team and how to deploy with it across accounts.
AWS CDK
Write infrastructure in TypeScript, Python, Java, C# or Go; cdk synth produces CloudFormation templates.
Constructs: L1 (raw CloudFormation), L2 (sensible defaults and helper methods like bucket.grantRead(role)), L3 patterns.
cdk diff shows changes; cdk deploy deploys through CloudFormation.
Bootstrapping (cdk bootstrap) creates the staging bucket, ECR repository and deployment roles in each account and Region. Deploying from a tooling account needs targets bootstrapped with --trust for that account.
CDK Pipelines creates a self-mutating CodePipeline that deploys stages to many accounts.
Aspects apply checks or changes across all constructs; cdk-nag checks best practices.
Unit tests with assertions on the synthesized template.
AWS SAM
A CloudFormation transform with shorthand types: AWS::Serverless::Function, Api, HttpApi, SimpleTable, StateMachine, LayerVersion.
sam build, sam deploy --guided, sam local invoke and sam local start-api for local testing.
sam sync --watch pushes code changes quickly to a dev stack.
DeploymentPreference with AutoPublishAlias gives canary or linear Lambda releases through CodeDeploy.
Policy templates give least-privilege permissions in a line.
Choosing
Mostly serverless, YAML-friendly team: SAM.
Complex infrastructure, reuse through code, strong typing: CDK.
Both end up as CloudFormation, so stack policies, drift detection and StackSets still apply.
Common traps
Deploying cross-account CDK apps without bootstrapping the target with trust.
Hand-writing Lambda traffic shifting that SAM provides.
Changing resources in the console after CDK created them.
A video streaming service uses the AWS CDK in a central tooling account to deploy an application stack into a separate production account. The CDK app synthesizes the template, and the team deploys it with cdk deploy from a pipeline.
The first deployment to production failed when the CDK CLI could not publish the template assets, because the production account had never been prepared for CDK deployments from the tooling account.
The security team requires that deployments to production use roles that exist in the production account, and that the tooling account's pipeline role get no broader access there than the CDK deployment needs.
Which action should the platform team take?
Choose one answer.
AA. Create an IAM user with administrator access in the production account, store its access keys in the pipeline, and let cdk deploy use those keys directly for every run.
BB. Copy the CDK app into a new SAM template, because SAM deploys without asset publishing, and deploy the resulting template with the pipeline's existing permissions.
CC. Run cdk synth in the production account and deploy its output with the pipeline, so that the CDK CLI never has to publish assets from the tooling account.
DD. Run cdk bootstrap in the production account with --trust set to the tooling account, so the bootstrap roles and asset bucket trust only that account.
Show the answer and explanation
Answer: D
A. Wrong: Administrator keys stored in a pipeline break the requirement to limit access, and they do not solve the asset publishing step. They also remain valid until someone rotates them by hand.
C. Wrong: Synthesis output still needs the asset files uploaded and the roles that deployment uses, so this does not remove the preparation step. It also moves the build into an account the security team does not want to change. Learn more: What is the AWS CDK? (opens in a new tab)
D. Right: Correct. Bootstrapping creates the deployment roles, file and image asset resources, and a CloudFormation execution role in the target environment. The trust setting limits those roles to the tooling account's pipeline. Learn more: AWS CDK bootstrapping (opens in a new tab)
Explanation
CDK deployments into another account need the target account bootstrapped, which creates the asset buckets and deployment roles there. Trusting the tooling account in that bootstrap keeps the roles inside the production account and limits what the pipeline can assume. Administrator keys, rewritten templates and synthesizing in the target account each break a stated requirement.
Want more on AWS CDK and AWS SAM? The 5 full-length practice sets have 8 more AWS CDK and AWS SAM questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →