Amazon DVA-C02: CloudFormation & Infrastructure as Code (SAM, CDK) — Study Guide
Part of the AWS Developer Associate DVA-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
CloudFormation core patterns and template best practices
CloudFormation templates should be authored as declarative, idempotent descriptions of resources, favoring small, focused stacks and nested stacks for complex architectures. Use the Resources section with explicit logical IDs, and prefer intrinsic functions such as !Ref, !GetAtt, !Sub, Fn::FindInMap, and Fn::If for composition and reuse. Validate templates with aws cloudformation validate-template or the SAM/CDK equivalents (sam validate, cdk synth) before creating change sets. Use ChangeSets (CreateChangeSet / ExecuteChangeSet) for review and to avoid surprise replacements; use DescribeChangeSet to inspect actions the stack will perform. Keep template body under CloudFormation limits by moving large inline code to S3 and referencing it (CodeUri, S3Bucket/S3Key), or break into nested stacks with AWS::CloudFormation::Stack. Enforce drift detection regularly using DetectStackDrift and DescribeStackResourceDrifts. Use DeletionPolicy and UpdateReplacePolicy to protect data-bearing resources, and enable termination protection on critical stacks. Integrate cfn-lint and cfn-guard into CI/CD to catch structural issues and policy violations early. For rapid iteration, leverage ChangeSets and resource-level update strategies to minimize blast radius; for Lambda functions use versioned deployments to make updates safe and reversible.
Parameterization, mappings, secrets, and sensitive data
Parameterize environment differences with CloudFormation Parameters and Mappings, using AllowedValues and ConstraintDescription to fail fast. Avoid embedding secrets or plaintext credentials in Parameters; instead use SecureString SSM Parameter Store or Secrets Manager and reference them via dynamic references like {{resolve:secretsmanager:mysecret:SecretString:password}} or use AWS::SSM::Parameter::Value<String> types. Mark sensitive parameters with NoEcho: true to mask values in the console, but recognize NoEcho does not encrypt at rest — use Secrets Manager for audit and rotation. Use Mappings and Fn::FindInMap for deterministic, environment-specific values (AMI IDs per region) and Fn::GetAZs for availability zone calculation. For resource references across stacks in the same region/account, export outputs and import them via Fn::ImportValue; remember imports cannot cross accounts or regions. Protect IAM principals used by CloudFormation by scoping roles with least privilege; prefer service-managed StackSet permissions or explicitly provision an administration role with limited scope. When passing environment variables to containers or Lambda, prefer referencing Secrets Manager ARNs or SSM Parameter ARNs and use runtime retrieval in the code, or use SAM/CDK features to inject secure values into environment with encryption via KMS.
Cross-account/region deployments, CDK and SAM multi-account patterns
Cross-account and cross-region deployments require orchestration beyond single-stack exports. For multi-account/multi-region deployments choose CloudFormation StackSets (CreateStackSet, CreateStackInstances) with service-managed permissions for Organizations or self-managed with an execution role in target accounts. For application code artifacts, use centralized S3 buckets with cross-account replication or bucket policies, or let tools publish assets per region: CDK uses bootstrap stacks and assets published via cdk-assets and requires cdk bootstrap in each account/region; CDK Pipelines (pipelines module) or aws-cdk CLI with –role-arn supports cross-account promotion. SAM uses sam package / sam deploy which uploads artifacts to an S3 bucket; for multi-account use CI/CD to package and push artifacts into target-account buckets and run deploys with appropriate credentials. Avoid CDK context lookups (VPC.fromLookup etc.) that require account-specific permission at synth time; instead explicitly pass identifiers as parameters to keep synth reproducible. Use AWS CodePipeline or GitHub Actions with assumed roles (sts:AssumeRole) to perform deploys into target accounts, ensuring bootstrap and necessary service-linked roles exist. Remember CloudFormation exports are regional; prefer StackSets or pipeline-driven deployments for cross-account distribution.
Custom resources, stack protection, and local/incremental deployment accelerators
Use custom resources when CloudFormation lacks a native resource type, implementing Lambda-backed providers that honor the CloudFormation response protocol for Create/Update/Delete events. Build idempotent handlers, respond with cfn-response or the CloudFormation CLI framework, and handle long-running actions with progress events or by storing state in DynamoDB. Be mindful of custom resource timeouts: CloudFormation has a maximum stack operation timeout and Lambda-backed resources must complete within that window or cause stack rollback. Protect critical resources with stack policies (SetStackPolicy) to block replacement or updates to specified logical IDs during stack updates, and enable termination protection for environments you cannot afford to delete. For incremental and local development, use the AWS SAM CLI (sam build, sam local invoke, sam local start-api) and sam sync for rapid code-only updates, and CDK watch or cdk deploy with assets to update only changed resources; these tools compute asset hashes (lambda asset hashing) so only changed code is republished. Integrate CloudFormation ChangeSets, Lambda versioning (AutoPublishAlias in SAM or lambda.Version in CDK), and CodeDeploy traffic-shifting for safe deployments. Common traps include exceeding template or parameter limits, using cross-account imports incorrectly, and initializing heavy SDK clients inside handlers causing cold-start latencies — prefer global, lazy-initialized clients with configurable timeouts and retry behavior.
Practical Problem: Use-Case Scenario
Scenario: AcmeMedia manages a multi-account AWS organization with separate Dev, Staging, and Prod accounts in the us-east-1 region. A serverless image-processing service (Lambda + S3 + DynamoDB) must be deployed consistently across all accounts with shared sensitive configuration stored centrally.
Challenge: Deploy the same CloudFormation/SAM/CDK stack across multiple accounts and ensure Lambda code artifacts are available in each target account securely, while keeping secrets out of templates.
Recommended Approach:
- Use AWS CloudFormation StackSets with service-managed permissions (aws cloudformation create-stack-set –stack-set-name ImageProcessor –template-body file://template.yaml) and then aws cloudformation create-stack-instances to target accounts and regions, or configure CDK Pipelines to synth and deploy per account with roles.
- Package Lambda assets using the CDK asset publishing (cdk bootstrap in each account/region) or sam package to an S3 bucket in each target account; automate asset copy via CI (CodeBuild using aws s3 cp or S3 replication) and use cdk deploy or sam deploy with target account credentials.
- Store sensitive configuration in AWS Secrets Manager in each account, referenced in the template via dynamic references ({{resolve:secretsmanager:arn:aws:secretsmanager:us-east-1:123456789012:secret:ImageProcSecret:SecretString:apiKey}}) or deploy a replicated secret via Secrets Manager replication feature, avoiding NoEcho parameters.
- Use ChangeSets (create-change-set, execute-change-set), enable termination protection on production stacks, and use stack policies to prevent accidental replacement of DynamoDB tables or S3 buckets during updates.
Rationale: StackSets and pipeline-driven deployments provide secure, auditable multi-account/region propagation while asset publishing and per-account secrets keep credentials local and auditable. ChangeSets, termination protection, and stack policies reduce risk during iterative deployments.
← Amazon DynamoDB · All domains · Deployment →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →