DVA-C02 Security Practice Question
A company uses AWS CloudFormation to deploy resources. The templates are stored in an S3 bucket. A developer wants to ensure that only authorized users can create stacks from these templates. What should be implemented?
⚠ Common exam trap
Watch out — candidates often assume S3 bucket policies alone are sufficient for access control, forgetting that IAM policies are required to authorize the CreateStack API call itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use IAM policies to control who can call CreateStack and add S3 bucket policies to restrict template access.
It combines two layers of access control: IAM policies restrict the ability to call the CreateStack API action, and S3 bucket policies restrict access to the template objects stored in S3. This ensures that even if a user has IAM permissions to create stacks, they cannot retrieve or use the template unless the S3 bucket policy also grants them access. Without both controls, an unauthorized user could bypass IAM by directly accessing the template URL or using a different AWS account.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use IAM policies to control who can call CreateStack and add S3 bucket policies to restrict template access.
Why this is correct
IAM policies are crucial for controlling which users or roles can invoke the `CreateStack` API action within CloudFormation, directly preventing unauthorized stack deployments. Concurrently, S3 bucket policies restrict access to the CloudFormation template file itself, ensuring only authorized entities can read or download it. This dual-layer approach provides robust preventative security by controlling both the action and the asset, embodying a defense-in-depth strategy.
- ✗
Use a stack policy to restrict updates.
Why it's wrong here
A stack policy is designed to protect the resources *within* an already deployed CloudFormation stack from unintended updates or deletions. It is applied *after* stack creation and governs subsequent `UpdateStack` operations, not the initial `CreateStack` call. Therefore, a stack policy offers no protection against unauthorized users creating new stacks or accessing the template file itself before deployment.
- ✗
Enable CloudTrail to log template access.
Why it's wrong here
Enabling CloudTrail provides an essential audit log of all API calls made to AWS services, including CloudFormation and S3. While critical for security monitoring, compliance, and forensic analysis, CloudTrail is a detective control that records events *after* they have occurred. It does not actively prevent unauthorized users from performing actions like calling `CreateStack` or accessing S3 templates; it only logs that such an attempt was made.
- ✗
Set the S3 bucket to private and rely on bucket policies.
Why it's wrong here
Setting an S3 bucket to private and relying solely on bucket policies effectively restricts direct access to the template file stored within S3. However, S3 bucket policies only govern permissions for S3 object operations, such as `s3:GetObject`. They do not control permissions for CloudFormation API actions like `cloudformation:CreateStack`, which requires specific IAM policies attached to the user or role attempting the deployment, making this an incomplete solution.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.