Refer to the Exhibit Practice Questions

The policy has a condition on the s3 actions that is not satisfied.

Why wrong: No condition on s3 actions.

The policy does not allow codebuild:StartBuild for the specific project.

Why wrong: The policy allows codebuild:StartBuild on all resources.

The policy does not allow s3:GetObject on the artifact bucket.

Why wrong: It does allow s3:GetObject on the bucket.

The policy does not include the 'cloudwatch:PutMetricData' action.

Why wrong: The IAM policy shown in the exhibit explicitly includes the cloudwatch:PutMetricData action in its Action array, so the Lambda execution role already has permission to publish metrics. The absence of that action is not the reason no metrics are appearing; if it were absent, the API call would fail with an AccessDenied error rather than silently produce nothing. This misdiagnosis ignores that the function is authorized and points instead to a missing permission that is clearly present.

The policy includes unnecessary actions that conflict with each other.

Why wrong: IAM policies do not define interactions between actions, so there is no concept of one action 'conflicting' with another. CloudWatch actions such as PutMetricData, ListMetrics, and GetMetricData can be listed together in the same policy and are evaluated independently for each request. Unnecessary actions might broaden permissions, but they do not block or cancel other actions, so this is not the cause of the function's failure to publish metrics.

The policy uses a wildcard resource, which is not allowed for the PutMetricData action.

Why wrong: The Resource element for cloudwatch:PutMetricData must be "*" because CloudWatch metrics are not ARN-backed resources and do not support resource-level permissions. This wildcard is not only allowed but is the only valid option for this action; attempting to scope access to a specific metric name or namespace is impossible. Therefore, a wildcard resource in this policy is a correct and necessary part of the authorization, not a flaw causing the problem.

The stack template contains a syntax error.

Why wrong: A template syntax error is caught by CloudFormation during validation before any physical resources are provisioned. The stack would immediately enter CREATE_FAILED with a reason such as 'Template format error: ...' or 'Invalid template property', and no 'Resource creation cancelled' event would ever be emitted. Because the failure occurs at the template-parsing stage, no in-progress resources exist to cancel, making this explanation inconsistent with the observed event.

The IAM role used for stack operations lacks permissions.

Why wrong: If the IAM role associated with the stack lacks the required permissions, resource provisioning fails with an API-level 'AccessDenied' error. The affected resource, and then the entire stack, transitions to CREATE_FAILED, and the event reason would contain something like 'API: iam:CreateRole AccessDenied' rather than a generic cancellation notice. This is a resource-level failure triggered by authorization checks, not an external halt of the entire stack creation operation.

A stack creation timeout was reached.

Why wrong: A stack creation timeout is the result of CloudFormation's internal watchdog detecting that the expected creation time has elapsed without successful completion. The stack status would become CREATE_FAILED with a reason such as 'Resource creation timed out' or 'The stack did not reach the required state within the specified time'. Unlike a cancellation, a timeout is a passive failure based on elapsed time, not an active user or automation action taken during provisioning.

The Lambda function does not have permission to write to DynamoDB.

Why wrong: This is incorrect because the IAM policy shown in the exhibit explicitly grants PutItem and UpdateItem on the MyTable resource. If DynamoDB write permissions were missing, the failure would occur as a DynamoDB AccessDeniedException when the function attempts to write, not as a VPC subnet/security group error. Since the function fails before reaching the DynamoDB call, the cause lies in the networking permissions, not DynamoDB access.

The Lambda function cannot create network interfaces in the VPC.

Why wrong: The policy does grant ec2:CreateNetworkInterface, so Lambda can indeed create the network interface once it has all necessary information. The problem is that the Lambda service must first describe the VPC subnets and security groups to choose which ones to use—actions that are not allowed in the policy. Missing ec2:DescribeSubnets and ec2:DescribeSecurityGroups blocks the ENI creation process, even though the create permission itself is present.

The DynamoDB table's resource policy denies access from Lambda.

Why wrong: A DynamoDB resource policy would only deny access if it explicitly listed the Lambda function's principal, and such a denial would produce a DynamoDB-specific error. Here, the error message is about VPC subnets, indicating that Lambda's network interface provisioning failed before the function's code could execute. Since the function never reaches the DynamoDB operation, a table-level resource policy denial cannot be the root cause of this failure.

The Lambda runtime (nodejs18.x) does not support X-Ray tracing.

Why wrong: The Node.js 18 Lambda runtime fully supports AWS X-Ray; the X-Ray SDK has official packages for Node.js and the runtime includes the required support for service-side tracing. Runtime version determines language support, not whether X-Ray is available, so this cannot be the cause of missing trace data. In fact, nodejs18.x is one of the actively traced runtimes in AWS Lambda.

The TracingConfig mode is set to 'Active' but should be 'PassThrough'.

Why wrong: TracingConfig mode should be Active when you want X-Ray to trace every invocation; PassThrough would only emit trace data when a parent tracing header already exists, which is not appropriate for unconditionally enabling tracing. Active is the correct setting for this use case, so the complaint that it 'should be PassThrough' is incorrect. The problem is not the mode but the role permissions.

The Lambda function code does not use the AWS X-Ray SDK.

Why wrong: Using the AWS X-Ray SDK in function code is required only to instrument downstream HTTP calls, databases, and to create custom subsegments; it is not required for Lambda itself to generate and upload the basic service trace. With Active tracing, Lambda automatically creates the invocation segment and the daemon uploads it if the execution role has the right permissions. Missing SDK usage would produce less detailed traces, but it would not prevent the function's own trace from reaching X-Ray.

Encrypted data with a KMS key.

Why wrong: The CloudTrail event name "CreateKey" does not correspond to any encryption operation. In AWS KMS, encrypting data records an "Encrypt", "GenerateDataKey", or "ReEncrypt" event, depending on the API call used. These events reference an existing KMS key in the resources field but never use "CreateKey" as the event name, so this log entry cannot represent an encryption action.

Rotated a KMS key.

Why wrong: Rotating a KMS key in AWS is performed manually via the "RotateKey" API or automatically by AWS, and automatic rotation is not recorded as a customer-visible CloudTrail event like "CreateKey". Manual rotation produces an event name of "RotateKey" (or "EnableKeyRotation"), not "CreateKey". Additionally, rotation does not create a new key resource; it generates new backing key material for the same key ARN, which is inconsistent with the "CreateKey" event name and the creation of a new resource in the log.

Deleted a KMS key.

Why wrong: Deleting a KMS key is a deliberate lifecycle action that first requires scheduling deletion via the "ScheduleKeyDeletion" API, which CloudTrail records as "ScheduleKeyDeletion". After the waiting period expires, the key is permanently deleted, and CloudTrail may record "DeleteKey" or a related deletion event. The event name "CreateKey" explicitly indicates a creation operation, not a deletion, and the log shows a new key resource being created, so it cannot represent a deleted key.

The build environment ran out of disk space.

Why wrong: An out-of-disk-space condition would not appear as a Gradle exit status 1 from `./gradlew build`; it would instead generate filesystem-level errors such as 'No space left on device' or 'Failed to write...' when Gradle tries to download dependencies or write its cache. Such an environment failure would likely interrupt the process earlier, for example during the `install` or `pre_build` phase, not as a clean non-zero exit from the build command itself.

The artifact packaging step failed.

Why wrong: The artifact packaging step, such as creating a ZIP/tarball or copying outputs to a designated directory, is defined in the `post_build` phase, which executes only after the `build` phase has exited successfully. Because `./gradlew build` stopped with status 1, the pipeline aborted during the `build` phase, meaning `post_build` never ran and therefore cannot be the cause of this failure.

The linting step failed.

Why wrong: In this buildspec, the `build` phase runs `./gradlew build`, a Gradle task that compiles code and runs tests; a separate linting task would be invoked explicitly (e.g., `./gradlew lint`) in `pre_build` or as its own command. A lint failure would produce lint-specific output and its own non-zero exit from that distinct command, not the generic status 1 from `./gradlew build`. Thus the linting step is not what caused the failure shown.

The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.

Why wrong: The Deny statement uses StringNotEquals to deny ec2:RunInstances for non-Production requests, but its action is limited to RunInstances and its condition evaluates only at launch time. It never applies to ec2:StopInstances, so it cannot 'deny all instances' for stop operations. Further, StringNotEquals is a legitimate condition operator; the issue is that the stop action has no Allow, not that the operator is malformed.

The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.

Why wrong: IAM action coverage is explicit; ec2:StopInstances is a distinct API action from ec2:RunInstances and ec2:TerminateInstances, so it is not included implicitly by a Deny that mentions only RunInstances. Stopping an instance is not a termination action in IAM terms, and resource/condition elements in that Deny apply only to instance launches. Thus this rationale misreads the statement's scope and cannot explain the stop failure.

The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.

Why wrong: In IAM, actions not explicitly allowed are implicitly denied, so the absence of ec2:StopInstances in the Allow statement alone prevents stopping instances regardless of their Development tag. There is no need to invoke another identity-based policy or an SCP; while such policies can broaden or further restrict permissions, they are not required to produce the failure. Therefore the tag-based reasoning does not identify the actual cause.

aws s3 ls | grep my-stack

Why wrong: Running `aws s3 ls` lists every S3 bucket in the account, then `grep my-stack` only pattern-matches bucket names containing 'my-stack'. This approach does not query CloudFormation at all, so it ignores the stack's declared `BucketName` output and any resources created outside S3; it also breaks if the bucket name differs from the stack name or if permissions restrict `s3:ListAllMyBuckets`. It is a brittle manual workaround, not a reliable API call tied to the stack.

aws cloudformation describe-stack-resources --stack-name my-stack --logical-resource-id BucketName --query "StackResources[0].PhysicalResourceId" --output text

Why wrong: This command retrieves the physical resource ID of the resource with logical ID 'BucketName', which is the bucket name. However, the exhibit shows outputs, not resources. Both could work, but the question asks based on the exhibit which shows outputs. Option A is more direct given the exhibit.

aws cloudformation describe-stacks --stack-name my-stack --query "Stacks[0].Outputs[OutputKey='BucketName'].OutputValue" --output text

Why wrong: This command fails because the JMESPath filter expression is invalid. In JMESPath, filtering an array uses the syntax `[?condition]` (e.g., `[?OutputKey=='BucketName']`), not bare brackets `[OutputKey=...]`. Additionally, the comparison operator must be `==`, not a single `=`, so the query `Outputs[OutputKey='BucketName']` will cause a JMESPath parse error or return no results. Even if `--query` syntactically accepted it, `--output text` would not produce the intended output, so this is incorrect.

Add a pre_build command to export AWS_DEFAULT_REGION using the AWS CLI.

Why wrong: Adding a pre_build command to export AWS_DEFAULT_REGION via the AWS CLI is ineffective and creates a circular dependency: the CLI's regional endpoints typically require AWS_DEFAULT_REGION to be set before the call, so the command cannot determine the region without already knowing it. Moreover, environment variables exported in one buildspec phase do not persist to later phases because CodeBuild executes each phase in a separate shell process, so the export would not help in the build phase anyway.

Replace $AWS_DEFAULT_REGION with a hardcoded region like us-east-1.

Why wrong: Hardcoding a region such as us-east-1 in the buildspec violates portability and would silently break builds when the project is run in a different region, because the CLI would target the wrong regional endpoint and create mismatched artifacts. It also hides the root cause—the missing environment variable—while doing nothing to teach or enforce proper configuration, and it requires manual edits for every region change.

Use the AWS_REGION environment variable instead of AWS_DEFAULT_REGION in the buildspec.

Why wrong: Although AWS_REGION is automatically set by CodeBuild, the buildspec likely uses $AWS_DEFAULT_REGION, which is not set. Changing to AWS_REGION would require modifying the buildspec, while setting AWS_DEFAULT_REGION in the project environment (option B) directly resolves the issue.

The UserData is not base64 encoded correctly

Why wrong: CloudFormation's `UserData` property accepts plain text and automatically base64-encodes it when creating the EC2 instance, unless you explicitly use `Fn::Base64`. Even if the script were not encoded correctly, the instance would still fail to execute it, but the error message would typically indicate a decoding or execution failure, not a missing `yum` command. In this scenario, the script is executing and reaching the `yum` command, so encoding is not the root cause.

The tags prevent user data from executing

Why wrong: EC2 instance tags are metadata key-value pairs that can be used for organization, billing, or automation, but they have no effect on whether UserData scripts execute. AWS documentation and behavior confirm that UserData scripts run during the first boot of the instance, regardless of any tags applied. The only factors that can block UserData execution are cloud-init misconfiguration, AMI-specific settings, or the script itself failing; tags are not one of them.

The AMI uses a different init system than systemd

Why wrong: The AMI's init system (systemd vs. SysVinit vs. Upstart) governs how services are started and managed, but it does not control the availability of the `yum` command. While a non-systemd init system might prevent cloud-init from properly executing as a service, the failure described—where the `yum` command itself cannot be found—is a package-manager absence issue, not an init-system incompatibility. The error would occur regardless of the init system if the underlying OS uses a different package manager.

The CodePipeline deployment action uses the wrong cluster.

Why wrong: The deployment action references the cluster in the ECS service definition, and an incorrect cluster name or ARN would cause the CodePipeline action to fail before any tasks are placed. Since the pipeline completed successfully and tasks are running, the cluster reference is demonstrably valid. A cluster mismatch would also surface as a ResourceNotFoundException or service discovery failure, not a database timeout.

The ECS service is not registered with a target group.

Why wrong: If the ECS service had no target group registration, the ALB would be unable to route traffic to the tasks and would return HTTP 503 Service Unavailable before any application code executes. The observed database timeout proves the container received incoming traffic and attempted to make an outbound connection, so the service must be correctly wired to a target group. Moreover, a missing target group registration would cause the deployment to fail health checks, not allow a green deployment.

The database is not available in the same Availability Zone.

Why wrong: An Availability Zone mismatch between the database and the ECS tasks does not produce a connection timeout, because VPC networking permits cross-AZ traffic by default. Even if tasks and the DB are in different AZs, the TCP connection succeeds unless a security group or NACL blocks it, and any added latency would be minimal. Additionally, managed database services like RDS/Aurora replicate across AZs transparently, so an AZ mismatch is not a logical configuration error that would cause this symptom.

The stack update is in progress.

Why wrong: An in-progress update would be surfaced as UPDATE_IN_PROGRESS (or one of the related transitional states like UPDATE_COMPLETE_CLEANUP_IN_PROGRESS), and CloudFormation would still be executing the change set. The terminal status ROLLBACK_COMPLETE shows that the update attempt has already ended, not that it is currently running. This status is reached only after a failed update has been fully reverted, so interpreting it as an ongoing operation misreads the stack lifecycle.

The stack was deleted successfully.

Why wrong: If the stack had been deleted, the terminal status would be DELETE_COMPLETE, and the stack itself would no longer appear in the describe-stacks output. During deletion CloudFormation removes the stack and all its resources, whereas ROLLBACK_COMPLETE means the stack still exists and has been restored to its previous known-good state. A deletion that fails leaves the status DELETE_FAILED, so ROLLBACK_COMPLETE cannot represent a successful deletion.

The stack was created successfully.

Why wrong: A successful creation is always reported as CREATE_COMPLETE; ROLLBACK_COMPLETE is a failure signal, not a success signal. In fact, if a create-stack call fails, CloudFormation rolls back and enters ROLLBACK_COMPLETE, but here the command is update-stack, and the stack already existed and had been updated previously. Because ROLLBACK_COMPLETE only describes the outcome of a failed operation that was reverted, it cannot indicate that the stack was created cleanly.

The policy does not include the ec2:DescribeRegions action, which is required to describe instances in other regions.

Why wrong: DescribeRegions is a separate EC2 endpoint action used to list the regions available to the account; it is not a prerequisite for calling DescribeInstances. EC2 DescribeInstances is a regional action invoked against a region endpoint (e.g., ec2.eu-west-1.amazonaws.com), and IAM evaluation checks only whether the principal is allowed to perform the ec2:DescribeInstances action on the resource. A policy lacking DescribeRegions does not prevent a user from describing instances in another region, because the DescribeInstances call itself does not require that capability; instance metadata and ARNs already convey region information. Therefore, this omission cannot explain the reported issue.

The Allow statement's Resource is set to '*' which only matches instances in the caller's region.

Why wrong: In IAM policies, the Resource element of '*' matches all resource ARNs across every region, not just the caller's region; EC2 instance ARNs include region but wildcards are not region-scoped. Because ec2:DescribeInstances is a list-type operation that does not support resource-level restrictions for specific instance IDs, AWS requires or accepts Resource '*' as the only meaningful scope, and it applies globally. Without a Condition block on ec2:Region, an Allow on ec2:DescribeInstances with Resource '*' grants the action from any region endpoint the caller chooses. Thus, the allow statement is not limited to the caller's region and cannot be the cause of cross-region describe failures.

The Deny statement for TerminateInstances implicitly denies all other EC2 actions in regions other than us-east-1.

Why wrong: An explicit Deny in IAM applies only to the actions named in its Action element and to the resource condition specified; it does not suppress or deny any other EC2 action. In this policy, the Deny statement targets TerminateInstances specifically, so DescribeInstances is evaluated independently and may still be granted by an Allow statement. The only way a user would be denied DescribeInstances in regions other than us-east-1 is if a separate policy/condition explicitly denies it, or if no Allow exists for that action (an implicit deny), neither of which is produced by the TerminateInstances Deny. Confusing an action-specific Deny with a blanket region-based denial is a common misunderstanding of IAM evaluation logic.

The encryption key is a KMS key that the role cannot access

Why wrong: The encryption key being a KMS key that the role cannot access is not the cause because the exhibit shows the default S3 encryption key (SSE-S3), not a customer-managed KMS key. SSE-S3 uses an AWS-managed key, so no kms:Decrypt permission is required in the service role. Even if a KMS key were used, CodePipeline would need kms:Decrypt permission, but the error message about missing s3:GetObject is a different, more fundamental issue.

The source type is S3, but the project expects CodeCommit

Why wrong: Source type is not the problem; the pipeline is explicitly configured with S3 as the source provider, and Amazon S3 is a supported source type in CodePipeline. The term 'project' likely refers to the CodeBuild project or pipeline, which does not have an inherent expectation of CodeCommit. Since the source configuration matches the S3 bucket specified, this option misidentifies the cause and does not align with the actual error.

The source location is incorrect

Why wrong: The source location is not incorrect because the error message and exhibit indicate the bucket and object key are properly formatted and the location exists. CodePipeline would not proceed to an IAM-related error if the bucket or key were invalid; it would fail with a 'bucket does not exist' or 'object not found' message. Thus, the problem is not a typo or wrong path, but a permissions gap on the service role.