Exams / SAP-C03 / Study guide / Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets)
Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets): SAP-C03 study notes and practice questions
What to know about Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets) for the SAP-C03 exam, from the Operational Excellence and Automation domain (20% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks how to define infrastructure so it can be repeated, reviewed and rolled out to a whole organization, usually with the least operational overhead and a controlled blast radius.
Declarative and imperative IaC
CloudFormation templates (JSON or YAML) are declarative: you describe the end state and CloudFormation works out the create, update and delete order.
The AWS CDK is imperative code (TypeScript, Python, Java, C#, Go) that synthesizes to a CloudFormation template. You get loops, conditions, classes and reusable constructs, but deployment still runs through CloudFormation stacks, with the same rollback and drift behavior.
When a step has no native resource type, a Lambda-backed custom resource runs imperative logic inside the stack lifecycle.
Deploying stacks safely
Change sets preview what an update will add, modify or replace before you run it.
Rollback triggers watch CloudWatch alarms during and after an update and roll back if one fires.
DeletionPolicy and UpdateReplacePolicy set to Retain or Snapshot keep data when a database or volume would otherwise be deleted or replaced.
Nested stacks and CDK constructs reuse patterns; resource import and the IaC generator bring existing resources under management.
StackSets for many accounts and Regions
One StackSet in an administrator account creates stack instances (one stack per account and Region) from one template.
Permission model
How it works
Fits
Self-managed
You create an administration role and an execution role in every target account
Specific accounts, or no AWS Organizations
Service-managed
Uses AWS Organizations; target OUs; can run from a delegated administrator account
Organization-wide baselines
Automatic deployment (service-managed only) deploys to accounts that join a target OU and can remove or retain stacks when an account leaves.
Service-managed StackSets don’t deploy into the management account, even when it sits in the targeted scope.
Operation preferences control blast radius: maximum concurrent accounts, failure tolerance, Region order, sequential or parallel Regions, and concurrency mode.
Parameter overrides per account or Region, and drift detection across all stack instances.
CDK across accounts
cdk bootstrap --trust <tooling account> creates the asset buckets and deployment roles in each target account, and CDK Pipelines deploys stages to many accounts and Regions. For identical baselines in every account, StackSets usually needs less work. See CI/CD and multi-account pipelines.
How to choose
Scenario wording
Choose
“Deploy the same security baseline to every account, including new ones”
Service-managed StackSet targeting OUs with automatic deployment
“Developers want loops, types and reusable components”
AWS CDK
“See exactly what will be replaced before the update runs”
Change set
“Roll back if errors rise after the stack update”
Rollback triggers with CloudWatch alarms
“Never lose the database if the stack is deleted”
DeletionPolicy: Snapshot or Retain, plus termination protection
“Run the StackSet from a member account, not the management account”
Delegated administrator for StackSets
Common traps
Scripts that loop over accounts calling create-stack when StackSets does it natively.
Self-managed permissions for an organization-wide rollout, which means creating roles in every account by hand.
Expecting a StackSet to deploy to the management account through an OU target.
Treating the CDK as a separate deployment engine: it still produces CloudFormation stacks.
Updating every account at 100% concurrency with zero failure tolerance tuning, so one bad template hits everything at once.
A car maker runs 40 AWS accounts across three Regions. Each account needs the same baseline stack that creates its VPC, its log bucket and its alarm topics, and new accounts join the organization every month.
The platform team wants a change to the baseline to reach every account and Region from one template, with new accounts receiving it automatically. The rollout must stop if a deployment fails in one Region.
Which solution meets these requirements?
Choose one answer.
AA. Ask an engineer to copy the stack into each account from the console, and run the deployment by hand in each Region, following a checklist.
BB. Write a script that loops over the account IDs, uses a long-lived administrator access key stored for each account, and deploys the stack in each Region one after another.
CC. Create a CloudFormation StackSet with service-managed permissions, deploy it to the organizational units with automatic deployment turned on, and set the failure tolerance and the maximum concurrency for the Regions.
DD. Deploy the baseline with a CDK app run from the management account that assumes an administrator role in each member account, and run the app again by hand whenever a new account joins.
Show the answer and explanation
Answer: C
A. Wrong: Hand copies across 40 accounts and three Regions are slow and error-prone, and the checklist does not stop a rollout when one Region fails. New accounts would also need a manual copy.
B. Wrong: Long-lived administrator keys for every account are a serious credential risk, and the loop has no built-in automatic deployment for new accounts. A failure partway through leaves the accounts in mixed states.
C. Right: Correct. Service-managed StackSets deploy to every account in the target organizational units, and automatic deployment adds new accounts without a ticket. The failure tolerance and concurrency settings stop the rollout when a Region fails.
D. Wrong: CDK can deploy to several accounts, but new accounts would wait for someone to run the app again. The app also lacks the StackSets failure tolerance that stops a rollout when a Region fails.
Explanation
Service-managed StackSets with automatic deployment reach every account in the target OUs, including new ones, and the failure tolerance settings stop a rollout that breaks. Manual copies, long-lived keys and a single management-account stack each miss the scale, the security or the stop requirement.
Want more on Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets)? The 5 full-length practice sets have 7 more Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Infrastructure as code and multi-account deployment (CloudFormation, CDK, StackSets)