3.1 - Provisioning with CloudFormation and StackSets
AWS SysOps Administrator objective 3.1 covers provisioning resources as infrastructure as code. AWS CloudFormation templates use Parameters, Mappings, Conditions, Resources and Outputs with intrinsic functions like Ref, Fn::GetAtt, Fn::Sub and Fn::ImportValue. You preview updates with change sets, share values across stacks with Export and ImportValue or nest stacks, protect resources with a stack policy, and keep data on delete with DeletionPolicy Retain or Snapshot. Drift detection shows when a resource was changed outside the template, and a failed create rolls back. CloudFormation StackSets deploy one template across many accounts and Regions, using self-managed or service-managed permissions with AWS Organizations. Dynamic references pull secrets from Secrets Manager or Parameter Store. Expect scenario questions about safe updates, protecting data on delete, or multi-account rollout, and ask which CloudFormation feature applies.
Preview a stack update = change set. Keep a database when the stack is deleted = DeletionPolicy Retain. One template across many accounts and Regions = StackSets.
Practice questions
1. Which AWS CLI command creates or updates a CloudWatch metric alarm?
- aws cloudwatch put-metric-alarm (correct answer)
- aws cloudwatch create-alarm-and-attach-sns-notification-topic
- aws cloudwatch set-alarm-state
- aws logs put-metric-filter
put-metric-alarm creates or updates a metric alarm idempotently. set-alarm-state only forces a temporary state for testing, and put-metric-filter belongs to CloudWatch Logs, not alarms.
2. A batch job must push its own 'JobsProcessed' count into CloudWatch. Which API call publishes this custom metric?
- PutMetricData (correct answer)
- PutMetricAlarm, which also creates the underlying metric automatically
- GetMetricData used in write mode for the custom namespace
- PutDashboard, embedding the value inside a widget definition
PutMetricData sends custom metric data points into a namespace; the metric is created on first publish. PutMetricAlarm only configures alarms, and GetMetricData is read-only.
3. Your team still uses a launch configuration. Which capability requires migrating to a launch template instead?
- Specifying a single AMI and instance type
- Versioning plus mixed instances policies (correct answer)
- Attaching one security group at launch
- Providing user data at boot
Launch templates support versioning, mixed instances policies, and newer features that launch configurations cannot express. A single AMI, one security group, and user data are all supported by both.
4. You must define which files and metrics the unified CloudWatch agent collects. Where does that live?
- In the log group tags, read by the agent at each startup automatically
- In the agent configuration JSON, often stored in SSM Parameter Store (correct answer)
- In a CloudWatch alarm that pushes the collection list down to the agent
- In the EC2 instance user data only, which the agent re-reads every minute
The agent reads a JSON config (logs collect_list, metrics collections) that teams commonly keep in SSM Parameter Store for reuse. Tags, alarms, and user data do not carry the agent's collection definition.
5. On a fresh EC2 host, which helper generates a starter unified CloudWatch agent configuration interactively?
- The aws logs create-configuration command in the AWS CLI
- The SSM Session Manager plugin running in unattended setup mode
- The cloud-init directive that writes the agent config during first boot
- The amazon-cloudwatch-agent-config-wizard on the instance (correct answer)
The config wizard shipped with the agent asks questions and writes a starter JSON config. There is no aws logs create-configuration command, Session Manager is for shell access, and cloud-init does not generate agent config interactively.
6. You want a custom health probe Lambda to run every five minutes, outside Synthetics. What schedules it cleanly?
- A CloudWatch alarm set to trigger the Lambda
- A metric stream configured with a five-minute delay
- An EventBridge scheduled rule invoking the Lambda (correct answer)
- A dashboard widget that refreshes every five minutes
An EventBridge scheduled rule (rate or cron) invokes the Lambda on a fixed interval, the standard way to run periodic checks. Alarms react to metrics not schedules, metric streams export data, and a dashboard refresh only redraws graphs.