DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The stack has a stack policy that prevents updates; modify the stack policy.

  Why it's wrong here

  A CloudFormation stack policy is an IAM-like resource policy that controls which physical resources can be updated, and if it blocks a change it returns a specific denial error such as 'Action denied by stack policy' during the update operation. The error described as 'Rate exceeded' is a throttling exception from the CloudFormation API itself, not a resource-level authorization failure, so modifying the stack policy would have no effect on the exception. Additionally, stack policies protect a stack against accidental updates but are completely unrelated to API request rate quotas.

• ✗

  The IAM role used by CloudFormation does not have sufficient permissions; update the role policy.

  Why it's wrong here

  Insufficient IAM permissions for the CloudFormation role would cause AccessDeniedException or 'is not authorized to perform' errors when CloudFormation tries to call other services like S3 or EC2 during stack creation or update, not an API rate limit error. The 'Rate exceeded' message specifically indicates that the account has exhausted the default CloudFormation API request quota due to too many concurrent stack operations, which is an account-level throttling condition, not a permissions problem. Updating the role policy would be the remedy for a lack of authorization, but it cannot fix API throttling.

• ✓

  The CloudFormation API rate limit is being hit; request a limit increase from AWS Support.

  Why this is correct

  The 'Rate exceeded' error is the exact textual representation of AWS API throttling, meaning the CloudFormation service is rejecting requests because the account's API request rate for that region has exceeded its allowed quota. This often occurs during CodePipeline deployments when multiple stages run large numbers of changeset creation, update, and describe calls concurrently, or when other automation is hammering the same CloudFormation API. The correct fix is to request a service quota increase for the CloudFormation API via Service Quotas or AWS Support, and also implement exponential backoff in the calling code to handle transient throttle responses while the increase is pending.

• ✗

  The pipeline is exceeding the CodePipeline execution frequency limit; reduce the number of pipeline executions.

  Why it's wrong here

  CodePipeline does not define a per-execution frequency limit that would surface as a 'Rate exceeded' error from within a CloudFormation stack action; its own API has separate throttling limits for the CodePipeline control plane, and those would return a 'ThrottlingException' in the pipeline's API calls, not in the CloudFormation update output. When a CloudFormation action in a pipeline fails with 'Rate exceeded,' it is the CloudFormation service that is throttling, not CodePipeline limiting how often you run the pipeline. Reducing pipeline executions would not raise the CloudFormation API quota and therefore would not resolve the root cause.

Go deeper

Related to this question