DOP-C02 Configuration Management and IaC Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Using the 'Ref' function with the parameter name

  Why it's wrong here

  The Ref function only returns the value of a template parameter or resource when given its logical ID. If you pass the name of an SSM parameter as a template parameter, Ref returns that name string literally, not the stored value from Parameter Store. It cannot dereference or look up the contents of a named SSM parameter, so secrets and configuration values remain inaccessible.

• ✗

  Using the 'Fn::ParamStore' intrinsic function

  Why it's wrong here

  CloudFormation's intrinsic function library includes Ref, Fn::GetAtt, Fn::Join, Fn::Sub, and Fn::ImportValue, but there is no Fn::ParamStore. Attempting to use it would result in a template validation error because the intrinsic function does not exist. The correct way to retrieve Parameter Store values is through dynamic references, not a made-up pseudo function.

• ✗

  Using 'Fn::GetAtt' on the Parameter Store resource

  Why it's wrong here

  Fn::GetAtt is only used to fetch attributes of resources that are explicitly declared inside the CloudFormation template, such as an AWS::SSM::Parameter resource. It cannot query an existing SSM parameter by name; doing so requires the logical ID of a resource created in the same stack. Additionally, using Fn::GetAtt on a non-existent or external Parameter Store resource would fail, and it is not designed for retrieving values from the Parameter Store service.

• ✓

  Using the 'resolve:ssm' dynamic reference

  Why this is correct

  The correct method is to use a dynamic reference, which CloudFormation resolves during stack create or update operations. For SSM Parameter Store, you write {{resolve:ssm:parameter-name:version}} (or without a version) to inject the parameter's value directly into your template properties. This approach works for both plaintext and, with resolve:ssm-secure, SecureString parameters, enabling secure, service-managed retrieval without hardcoding secrets.

Go deeper

Related to this question