SOA-C03 practice question: CloudFormation and the AWS CDK (2 of 3)

Deployment, Provisioning, and Automation A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

A ski resort's CloudFormation stack launches an EC2 instance whose user data installs and configures the ticketing application, which takes about eight minutes. The stack reports CREATE_COMPLETE about two minutes after launch, before the application is ready, and when the install script fails the stack still reports success. The team wants the stack to complete only after the application is installed, and to roll back if the install fails or takes over 15 minutes. What should a CloudOps engineer do?

Choose one answer.

A. Add a DependsOn attribute to the instance that names the application's security group and IAM instance profile.
B. Add a CreationPolicy with a 15-minute resource signal timeout to the instance, and run cfn-signal with the install script's exit status at the end of user data.
C. Add an UpdatePolicy attribute with a 15-minute pause time to the instance so that CloudFormation waits before marking it complete.
D. Add a CloudWatch alarm on the instance's status checks to the template and set the stack's rollback trigger to that alarm.

Show the answer and explanation

Answer: B

A. Wrong: DependsOn controls the order in which CloudFormation creates resources. It cannot wait for software inside the instance to finish installing. Learn more: DependsOn attribute (opens in a new tab)
B. Right: Correct. With a CreationPolicy, CloudFormation waits for a success signal before marking the instance complete. cfn-signal reports the script's result, and a failure signal or a timeout makes the stack roll back. Learn more: CreationPolicy attribute (opens in a new tab)
C. Wrong: UpdatePolicy applies to updates of resources such as Auto Scaling groups, not to the creation of a single instance. It would not detect a failed install. Learn more: UpdatePolicy attribute (opens in a new tab)
D. Wrong: Rollback triggers watch alarms during stack operations, but status checks pass as soon as the operating system boots. A failed application install would not change them. Learn more: Roll back your CloudFormation stack on alarm breach with rollback triggers (opens in a new tab)

Explanation

By default CloudFormation marks an instance complete when EC2 reports it running, which says nothing about the software inside. A CreationPolicy makes CloudFormation wait for signals, and cfn-signal sends success or failure from user data. If no success signal arrives before the timeout, the resource fails and the stack rolls back.

SOA-C03 practice question: CloudFormation and the AWS CDK (2 of 3)

Explanation

Study

Keep practicing