CloudFormation templates, change sets and stack updates: DOP-C02 study notes and practice questions
What to know about CloudFormation templates, change sets and stack updates for the DOP-C02 exam, from the Configuration Management and IaC domain (17% of the exam guide), then 2 free questions to test it. Part of the DOP-C02 study guide.
CloudFormation questions ask how to change stacks safely, protect critical resources and keep templates in step with reality.
Previewing and applying changes
Change sets show what an update will add, modify or replace before you execute it.
Property changes have an update behavior: no interruption, some interruption, or replacement (a new physical resource, such as renaming an RDS instance).
Rollback triggers watch CloudWatch alarms during and after an update and roll back if they fire.
An online retailer manages its order-history database with an AWS CloudFormation stack. The stack includes a DynamoDB table whose partition key is about to change, and the team knows that a key change forces CloudFormation to replace the table, deleting its data.
The team needs to keep normal stack updates running, such as changes to the Lambda functions and IAM roles in the same stack, while making sure that no update can replace or delete the table without a deliberate decision.
The change must be enforced by CloudFormation itself, and it should not depend on each engineer remembering to review a change set.
Which approach meets these requirements?
Choose one answer.
AA. Attach a stack policy that denies the Update:Replace and Update:Delete actions on the table's logical ID, and allows all other updates to the stack.
BB. Turn on termination protection for the stack, so that no one can delete it, and rely on change set reviews to catch any update that would replace the table.
CC. Set the table's DeletionPolicy to Retain, so that the old table is kept if CloudFormation replaces it, and then update the key during a change window.
DD. Add an IAM policy to the deployment role that denies the dynamodb:DeleteTable action, so that any replacement of the table fails when the stack tries to remove the old table.
Show the answer and explanation
Answer: A
A. Right: Correct. A stack policy is enforced by CloudFormation for every update, and a deny on Update:Replace stops a key change from replacing the table. Updates to the functions and roles remain allowed. Learn more: Prevent updates to stack resources (opens in a new tab)
C. Wrong: Retain keeps the old table after a replacement, but the replacement still happens and the application loses its live table. The data would then need a manual migration, which the team wanted to avoid. Learn more: DeletionPolicy attribute (opens in a new tab)
D. Wrong: CloudFormation creates the replacement table first and deletes the old one only during cleanup, so this deny does not stop the replacement. The stack would point at a new, empty table while the old one is left behind.
Explanation
A stack policy is evaluated by CloudFormation on every update, so it can deny the replacement or deletion of one resource while other updates proceed. Termination protection, a retain policy and a permission deny each either protect a different action or depend on people to notice the replacement.
An online retailer manages its checkout network with an AWS CloudFormation stack. A stack update that adds an inbound rule to a security group failed because a rule with the same port and source already exists; an engineer had added it in the console during an incident.
The security team wants the stack to describe the approved configuration again, without deleting the security group, which other stacks reference through exports. Before anything changes, the team wants to see every property of the stack's resources that no longer matches the template.
The update must be done through CloudFormation so that the stack's history stays complete and the change is reviewed in a change set first.
Which approach meets these requirements?
Choose one answer.
AA. Delete the stack with the retain option for the security group, create a new stack with the approved template, and import the retained security group into the new stack.
BB. Use the security group's DeletionPolicy of Snapshot and update the template with the approved rules, so that CloudFormation replaces the group and keeps a backup of the old rules.
CC. Update the stack with the template again, and let CloudFormation overwrite the manual rule, because CloudFormation always restores resources to their template state during an update.
DD. Run drift detection to identify the changed resource and property values, then either remove the manual rule or add it to the template, and run a change set before the update.
Show the answer and explanation
Answer: D
A. Wrong: Deleting the stack breaks the exports that other stacks reference, and the import adds a second change. The stack history is also no longer continuous, which the team wanted to keep. Learn more: DeletionPolicy attribute (opens in a new tab)
B. Wrong: Snapshot is not a supported deletion policy for security groups, and forcing a replacement would change the group's ID, which breaks the other stacks that import it. It also does not show which properties drifted. Learn more: DeletionPolicy attribute (opens in a new tab)
Drift detection reports which resource properties changed outside CloudFormation, so the team sees the manual rule before changing anything. The team then removes the rule or adds it to the template, and a change set shows the result before the update. Deleting the stack or replacing the group breaks exports, and rerunning the update does not undo manual changes.
Want more on CloudFormation templates, change sets and stack updates? The 5 full-length practice sets have 9 more CloudFormation templates, change sets and stack updates questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study CloudFormation templates, change sets and stack updates