You create custom AMIs by launching EC2 instances via a CloudFormation template, installing software with AWS OpsWorks (which can take 2–3 hours), and then imaging the instances. Sometimes the install stalls, and you want the CloudFormation stack to fail and roll back if that happens. What should you add to the template to enforce this with a 4-hour limit?

A CreationPolicy allows you to specify a ResourceSignal with a Timeout property. This policy instructs CloudFormation to wait for a specific number of success signals from the EC2 instance (or other resource) within the defined timeout period before marking the resource creation as complete. If the signals are not received within the 4-hour timeout, the resource creation fails, triggering a stack rollback. Conditions are used for conditional resource creation, not for timing out resource provisioning. DependsOn defines resource dependencies, ensuring resources are created in a specific order, but it doesn't enforce timeouts for individual resource provisioning. Metadata is for arbitrary data associated with a resource and does not control resource creation timeouts.