SAP-C03 practice question: Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets)
Operational Excellence and Automation A free question from our original SAP-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A car maker runs 40 AWS accounts across three Regions. Each account needs the same baseline stack that creates its VPC, its log bucket and its alarm topics, and new accounts join the organization every month.
The platform team wants a change to the baseline to reach every account and Region from one template, with new accounts receiving it automatically. The rollout must stop if a deployment fails in one Region.
Which solution meets these requirements?
Choose one answer.
AA. Ask an engineer to copy the stack into each account from the console, and run the deployment by hand in each Region, following a checklist.
BB. Write a script that loops over the account IDs, uses a long-lived administrator access key stored for each account, and deploys the stack in each Region one after another.
CC. Create a CloudFormation StackSet with service-managed permissions, deploy it to the organizational units with automatic deployment turned on, and set the failure tolerance and the maximum concurrency for the Regions.
DD. Deploy the baseline with a CDK app run from the management account that assumes an administrator role in each member account, and run the app again by hand whenever a new account joins.
Show the answer and explanation
Answer: C
A. Wrong: Hand copies across 40 accounts and three Regions are slow and error-prone, and the checklist does not stop a rollout when one Region fails. New accounts would also need a manual copy.
B. Wrong: Long-lived administrator keys for every account are a serious credential risk, and the loop has no built-in automatic deployment for new accounts. A failure partway through leaves the accounts in mixed states.
C. Right: Correct. Service-managed StackSets deploy to every account in the target organizational units, and automatic deployment adds new accounts without a ticket. The failure tolerance and concurrency settings stop the rollout when a Region fails.
D. Wrong: CDK can deploy to several accounts, but new accounts would wait for someone to run the app again. The app also lacks the StackSets failure tolerance that stops a rollout when a Region fails.
Explanation
Service-managed StackSets with automatic deployment reach every account in the target OUs, including new ones, and the failure tolerance settings stop a rollout that breaks. Manual copies, long-lived keys and a single management-account stack each miss the scale, the security or the stop requirement.
Want more on Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets)? The 5 full-length practice sets have 7 more Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →