Resources section in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding AWS CloudFormation Resources Section

In AWS CloudFormation, what is the primary purpose of the Resources section in a template?

A To set conditions that control whether certain resources are created.

B To specify the output values that the stack will return after creation.

C To declare parameters that users must input when launching the stack.

D To define the AWS infrastructure components like EC2 instances, S3 buckets, and IAM roles that will be created or updated.

💡 Hint

Think about where you describe the actual AWS services you want to build.

The Resources section is where you list all the AWS components you want CloudFormation to create or manage. Parameters, outputs, and conditions are separate sections.

❓ Configuration

intermediate

Identifying a Valid Resource Definition in CloudFormation

Which of the following Resources section snippets will successfully create an S3 bucket with versioning enabled?

A

MyBucket:
  Type: AWS::S3::Bucket
  Properties:
    VersioningConfiguration:
      Status: Enabled

B

MyBucket:
  Type: AWS::S3::Bucket
  Properties:
    Versioning:
      Enabled: true

C

MyBucket:
  Type: AWS::S3::Bucket
  Properties:
    VersioningConfiguration:
      Status: True

D

MyBucket:
  Type: AWS::S3::Bucket
  Properties:
    VersioningConfiguration:
      State: Enabled

💡 Hint

Check the exact property names and values required by AWS for enabling versioning.

The correct property to enable versioning is VersioningConfiguration with Status set to Enabled. Other options use incorrect property names or values.

❓ Architecture

advanced

Choosing the Correct Resource Dependency Configuration

You have two resources in your CloudFormation template: an EC2 instance and an EBS volume. The EC2 instance must be created only after the EBS volume is ready. Which resource property correctly enforces this dependency?

A Place the EC2 instance resource before the EBS volume resource in the template.

B Use the Condition section to create the EC2 instance only if the EBS volume exists.

C Add a DependsOn attribute to the EC2 instance resource referencing the EBS volume resource name.

D Set the EBS volume's Properties to include the EC2 instance's ID.

💡 Hint

Think about how CloudFormation controls creation order explicitly.

The DependsOn attribute explicitly tells CloudFormation to create one resource after another. The order of resource declaration or conditions does not enforce creation order.

❓ security

advanced

Securing an IAM Role Resource in CloudFormation

Which of the following Resources section snippets correctly defines an IAM role with a policy that allows only read access to S3 buckets?

A

MyRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Statement:
        - Effect: Allow
          Principal:
            Service: ec2.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: ReadS3
        PolicyDocument:
          Statement:
            - Effect: Allow
              Action:
                - s3:GetObject
                - s3:ListBucket
              Resource: '*'

B

MyRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Statement:
        - Effect: Allow
          Principal:
            Service: ec2.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: ReadS3
        PolicyDocument:
          Statement:
            - Effect: Allow
              Action: s3:*
              Resource: '*'

C

MyRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Statement:
        - Effect: Deny
          Principal:
            Service: ec2.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: ReadS3
        PolicyDocument:
          Statement:
            - Effect: Allow
              Action:
                - s3:GetObject
                - s3:ListBucket
              Resource: '*'

D

MyRole:
  Type: AWS::IAM::Role
  Properties:
    AssumeRolePolicyDocument:
      Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole
    Policies:
      - PolicyName: ReadS3
        PolicyDocument:
          Statement:
            - Effect: Allow
              Action:
                - s3:GetObject
                - s3:ListBucket
              Resource: '*'

💡 Hint

Check the service principal and the actions allowed in the policy.

Option A correctly allows EC2 to assume the role and grants only read permissions to S3. Option A allows all S3 actions, C denies assume role, and D uses Lambda service principal instead of EC2.

❓ service_behavior

expert

Predicting CloudFormation Stack Behavior with Resource Updates

You update a CloudFormation template's Resources section by changing the InstanceType property of an EC2 instance resource from t2.micro to t3.micro. What will CloudFormation do when you update the stack?

A CloudFormation will fail the update with a validation error due to incompatible instance types.

B CloudFormation will replace the EC2 instance by creating a new one with the new instance type and deleting the old one.

C CloudFormation will ignore the change because instance type is not an updatable property.

D CloudFormation will perform an in-place update of the EC2 instance, changing the instance type without replacement.

💡 Hint

Consider whether changing instance type requires replacement or can be updated in place.

Changing the InstanceType property of an AWS::EC2::Instance resource causes CloudFormation to replace the instance by default, creating a new instance and deleting the old one.