Custom resources, helper scripts and stack policies: DOP-C02 study notes and practice questions
What to know about Custom resources, helper scripts and stack policies for the DOP-C02 exam, from the Configuration Management and IaC domain (17% of the exam guide), then 1 free question to test it. Part of the DOP-C02 study guide.
These questions test how CloudFormation behaves at the edges: custom logic, instance bootstrapping and stuck stacks.
Custom resources
A Custom:: resource calls a Lambda function (or SNS topic) on Create, Update and Delete.
The handler must send a response (SUCCESS or FAILED) to the pre-signed S3 URL in the event. If it doesn’t, the stack waits up to an hour and then fails.
Handle every request type and every error path, including Delete, or stacks can’t be removed.
The cfn-response module or the CDK provider framework simplifies this.
Bootstrapping EC2
Helper
Does
cfn-init
Reads AWS::CloudFormation::Init metadata to install packages, write files and start services
cfn-signal
Tells CloudFormation the instance is ready (or failed)
cfn-hup
Watches metadata for changes and re-runs cfn-init
cfn-get-metadata
Reads metadata
A CreationPolicy waits for a number of signals within a timeout; Auto Scaling groups use it so the stack completes only when instances are healthy.
An UpdatePolicy with AutoScalingRollingUpdate or AutoScalingReplacingUpdate controls instance replacement.
WaitCondition handles signals from outside the stack.
Macros and transforms
AWS::Serverless (SAM) and AWS::Include are AWS transforms.
Macros run Lambda functions to process templates.
AWS::LanguageExtensions adds Fn::ForEach and more.
Stuck stacks
UPDATE_ROLLBACK_FAILED: fix the blocking resource (such as emptying a bucket), then ContinueUpdateRollback, optionally skipping resources.
DELETE_FAILED: often a non-empty bucket or a resource in use; fix and retry, or retain it.
Common traps
A custom resource handler that crashes without responding.
Deleting and recreating a stack in UPDATE_ROLLBACK_FAILED.
No CreationPolicy, so the stack reports success before the app is ready.
A hospital network deploys a CloudFormation stack that includes a custom resource. An AWS Lambda function behind the custom resource creates a database parameter group that the clinical reporting database needs.
After a recent change, stack creation hung for an hour and then failed with a timeout on the custom resource, even though the parameter group existed in the account. The Lambda function returned normally, but an exception in a helper path skipped the code that reports back to CloudFormation.
The operations team wants any future failure in the custom resource to end the stack operation quickly and report the reason, instead of making CloudFormation wait for its timeout.
Which change meets these requirements?
Choose one answer.
AA. Increase the custom resource's ServiceTimeout to the maximum allowed value, so that the stack waits longer and the function has more time to finish its work.
BB. Wrap the handler so that every event, including exceptions, sends a SUCCESS or FAILED response with the reason to the pre-signed response URL that CloudFormation supplies.
CC. Move the parameter group out of the template and create it with a CloudFormation StackSet, so that the custom resource no longer runs in the stack's account.
DD. Add a CreationPolicy with a count of one to the custom resource, so that CloudFormation waits for a signal from the function and fails the resource when the signal is missing.
Show the answer and explanation
Answer: B
A. Wrong: A longer timeout makes the stack wait longer before it fails, which is the opposite of the goal. The function still would not report back when an exception skips the response code.
B. Right: Correct. CloudFormation waits for a response to the pre-signed URL in each custom resource event, so a handler that always responds lets the stack fail fast with the reason. The stack then rolls back promptly, and the error text appears in the events. Learn more: Create custom provisioning logic with custom resources (opens in a new tab)
D. Wrong: CreationPolicy applies to EC2 instances and Auto Scaling groups that send cfn-signal messages. It is not the mechanism for a custom resource's response, so it does not fix the hang. Learn more: CreationPolicy attribute (opens in a new tab)
Explanation
A custom resource is complete only when its handler sends a response to the pre-signed URL that CloudFormation provides. A handler that responds with SUCCESS or FAILED on every path lets the stack fail quickly and show the reason. Longer timeouts, StackSets and creation policies do not address the missing response.
Want more on Custom resources, helper scripts and stack policies? The 5 full-length practice sets have 7 more Custom resources, helper scripts and stack policies questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Custom resources, helper scripts and stack policies