Refer to the Exhibit Practice Questions

The policy does not include the 'cloudwatch:PutMetricData' action.

Why it fails: The IAM policy shown in the exhibit explicitly includes the cloudwatch:PutMetricData action in its Action array, so the Lambda execution role already has permission to publish metrics. The absence of that action is not the reason no metrics are appearing; if it were absent, the API call would fail with an AccessDenied error rather than silently produce nothing. This misdiagnosis ignores that the function is authorized and points instead to a missing permission that is clearly present.

The policy includes unnecessary actions that conflict with each other.

Why it fails: IAM policies do not define interactions between actions, so there is no concept of one action 'conflicting' with another. CloudWatch actions such as PutMetricData, ListMetrics, and GetMetricData can be listed together in the same policy and are evaluated independently for each request. Unnecessary actions might broaden permissions, but they do not block or cancel other actions, so this is not the cause of the function's failure to publish metrics.

The policy uses a wildcard resource, which is not allowed for the PutMetricData action.

Why it fails: The Resource element for cloudwatch:PutMetricData must be "*" because CloudWatch metrics are not ARN-backed resources and do not support resource-level permissions. This wildcard is not only allowed but is the only valid option for this action; attempting to scope access to a specific metric name or namespace is impossible. Therefore, a wildcard resource in this policy is a correct and necessary part of the authorization, not a flaw causing the problem.

The stack template contains a syntax error.

Why it fails: A template syntax error is caught by CloudFormation during validation before any physical resources are provisioned. The stack would immediately enter CREATE_FAILED with a reason such as 'Template format error: ...' or 'Invalid template property', and no 'Resource creation cancelled' event would ever be emitted. Because the failure occurs at the template-parsing stage, no in-progress resources exist to cancel, making this explanation inconsistent with the observed event.

The IAM role used for stack operations lacks permissions.

Why it fails: If the IAM role associated with the stack lacks the required permissions, resource provisioning fails with an API-level 'AccessDenied' error. The affected resource, and then the entire stack, transitions to CREATE_FAILED, and the event reason would contain something like 'API: iam:CreateRole AccessDenied' rather than a generic cancellation notice. This is a resource-level failure triggered by authorization checks, not an external halt of the entire stack creation operation.

A stack creation timeout was reached.

Why it fails: A stack creation timeout is the result of CloudFormation's internal watchdog detecting that the expected creation time has elapsed without successful completion. The stack status would become CREATE_FAILED with a reason such as 'Resource creation timed out' or 'The stack did not reach the required state within the specified time'. Unlike a cancellation, a timeout is a passive failure based on elapsed time, not an active user or automation action taken during provisioning.

The install phase did not run because npm install is not in the correct phase.

Why it fails: The install phase is a legitimate top-level key in a buildspec and executes before pre_build and build, so placing 'npm install' under 'install.commands' is syntactically correct. CodeBuild's phase order is fixed: install, pre_build, build, post_build — any commands listed there run as expected and do not prevent the build phase from running. The failure occurs later, during artifact collection, because of a missing directory, not because npm install was skipped or misplaced.

The artifacts files pattern '**/*' is invalid.

Why it fails: The files pattern '**/*' is a glob pattern that recursively matches every file and directory under the base-directory; it is the standard way to include all build output. CodeBuild uses glob matchers that support double-asterisk for zero or more directories, so this pattern is entirely valid. An invalid pattern would be something like an absolute path outside the workspace or a malformed expression, but '**/*' is accepted and commonly used in buildspec artifacts.

The runtime version nodejs 14 is not supported by CodeBuild.

Why it fails: CodeBuild's standard Amazon Linux images include multiple Node.js runtime versions, and Node.js 14 is officially supported as a runtime for the 'nodejs' environment. The buildspec snippet correctly declares 'runtime: nodejs:14' and it will resolve to an available image tag in the CodeBuild managed image. If the runtime version were unsupported, CodeBuild would fail during environment provisioning, but the error described here is about the artifacts path, not the runtime.

The bucket is deleted because the stack deletion overrides the DeletionPolicy.

Why it fails: This statement reverses the actual precedence. CloudFormation's DeletionPolicy attribute is evaluated as part of the stack deletion operation and is the final authority on whether a physical resource is removed; a plain stack deletion cannot override it. With 'Retain' set, CloudFormation deliberately skips the bucket deletion, so the bucket is preserved despite the stack being successfully deleted.

The stack deletion fails because the bucket has versioning enabled.

Why it fails: S3 bucket versioning has no bearing on CloudFormation stack deletion mechanics. Versioning is a bucket-level data-protection feature; it does not lock the bucket against deletion of the bucket itself, nor does it cause CloudFormation to fail a stack deletion. In the absence of a Retain policy, CloudFormation can delete a versioned bucket by purging all object versions and delete markers before issuing the DELETE_BUCKET call. More importantly, because this stack uses Retain, the deletion action is never attempted, so versioning cannot trigger a failure.

The bucket is deleted along with the stack because the DeletionPolicy is not supported for S3 buckets.

Why it fails: This claim is factually incorrect because DeletionPolicy is explicitly supported for AWS::S3::Bucket and is widely used for exactly this purpose. The CloudFormation documentation lists S3::Bucket as a resource that supports the Retain value, and the default (no policy) is Delete. Defining 'DeletionPolicy: Retain' on the bucket is the standard way to prevent data loss when a stack is removed; therefore the bucket is preserved, not deleted.

The build environment ran out of disk space.

Why it fails: An out-of-disk-space condition would not appear as a Gradle exit status 1 from `./gradlew build`; it would instead generate filesystem-level errors such as 'No space left on device' or 'Failed to write...' when Gradle tries to download dependencies or write its cache. Such an environment failure would likely interrupt the process earlier, for example during the `install` or `pre_build` phase, not as a clean non-zero exit from the build command itself.

The artifact packaging step failed.

Why it fails: The artifact packaging step, such as creating a ZIP/tarball or copying outputs to a designated directory, is defined in the `post_build` phase, which executes only after the `build` phase has exited successfully. Because `./gradlew build` stopped with status 1, the pipeline aborted during the `build` phase, meaning `post_build` never ran and therefore cannot be the cause of this failure.

The linting step failed.

Why it fails: In this buildspec, the `build` phase runs `./gradlew build`, a Gradle task that compiles code and runs tests; a separate linting task would be invoked explicitly (e.g., `./gradlew lint`) in `pre_build` or as its own command. A lint failure would produce lint-specific output and its own non-zero exit from that distinct command, not the generic status 1 from `./gradlew build`. Thus the linting step is not what caused the failure shown.

The Deny statement condition incorrectly uses StringNotEquals, which denies all instances except those with the Production tag.

Why it fails: The Deny statement uses StringNotEquals to deny ec2:RunInstances for non-Production requests, but its action is limited to RunInstances and its condition evaluates only at launch time. It never applies to ec2:StopInstances, so it cannot 'deny all instances' for stop operations. Further, StringNotEquals is a legitimate condition operator; the issue is that the stop action has no Allow, not that the operator is malformed.

The Deny statement includes ec2:StopInstances implicitly because stop is a termination action.

Why it fails: IAM action coverage is explicit; ec2:StopInstances is a distinct API action from ec2:RunInstances and ec2:TerminateInstances, so it is not included implicitly by a Deny that mentions only RunInstances. Stopping an instance is not a termination action in IAM terms, and resource/condition elements in that Deny apply only to instance launches. Thus this rationale misreads the statement's scope and cannot explain the stop failure.

The policy does not prevent stopping instances with the Development tag; the failure must be caused by another policy or service control policy.

Why it fails: In IAM, actions not explicitly allowed are implicitly denied, so the absence of ec2:StopInstances in the Allow statement alone prevents stopping instances regardless of their Development tag. There is no need to invoke another identity-based policy or an SCP; while such policies can broaden or further restrict permissions, they are not required to produce the failure. Therefore the tag-based reasoning does not identify the actual cause.

aws s3 ls | grep my-stack

Why it fails: Running `aws s3 ls` lists every S3 bucket in the account, then `grep my-stack` only pattern-matches bucket names containing 'my-stack'. This approach does not query CloudFormation at all, so it ignores the stack's declared `BucketName` output and any resources created outside S3; it also breaks if the bucket name differs from the stack name or if permissions restrict `s3:ListAllMyBuckets`. It is a brittle manual workaround, not a reliable API call tied to the stack.

aws cloudformation describe-stack-resources --stack-name my-stack --logical-resource-id BucketName --query "StackResources[0].PhysicalResourceId" --output text

Why it fails: This command retrieves the physical resource ID of the resource with logical ID 'BucketName', which is the bucket name. However, the exhibit shows outputs, not resources. Both could work, but the question asks based on the exhibit which shows outputs. Option A is more direct given the exhibit.

aws cloudformation describe-stacks --stack-name my-stack --query "Stacks[0].Outputs[OutputKey='BucketName'].OutputValue" --output text

Why it fails: This command fails because the JMESPath filter expression is invalid. In JMESPath, filtering an array uses the syntax `[?condition]` (e.g., `[?OutputKey=='BucketName']`), not bare brackets `[OutputKey=...]`. Additionally, the comparison operator must be `==`, not a single `=`, so the query `Outputs[OutputKey='BucketName']` will cause a JMESPath parse error or return no results. Even if `--query` syntactically accepted it, `--output text` would not produce the intended output, so this is incorrect.

Add a pre_build command to export AWS_DEFAULT_REGION using the AWS CLI.

Why it fails: Adding a pre_build command to export AWS_DEFAULT_REGION via the AWS CLI is ineffective and creates a circular dependency: the CLI's regional endpoints typically require AWS_DEFAULT_REGION to be set before the call, so the command cannot determine the region without already knowing it. Moreover, environment variables exported in one buildspec phase do not persist to later phases because CodeBuild executes each phase in a separate shell process, so the export would not help in the build phase anyway.

Replace $AWS_DEFAULT_REGION with a hardcoded region like us-east-1.

Why it fails: Hardcoding a region such as us-east-1 in the buildspec violates portability and would silently break builds when the project is run in a different region, because the CLI would target the wrong regional endpoint and create mismatched artifacts. It also hides the root cause—the missing environment variable—while doing nothing to teach or enforce proper configuration, and it requires manual edits for every region change.

Use the AWS_REGION environment variable instead of AWS_DEFAULT_REGION in the buildspec.

Why it fails: Although AWS_REGION is automatically set by CodeBuild, the buildspec likely uses $AWS_DEFAULT_REGION, which is not set. Changing to AWS_REGION would require modifying the buildspec, while setting AWS_DEFAULT_REGION in the project environment (option B) directly resolves the issue.

The UserData is not base64 encoded correctly

Why it fails: CloudFormation's `UserData` property accepts plain text and automatically base64-encodes it when creating the EC2 instance, unless you explicitly use `Fn::Base64`. Even if the script were not encoded correctly, the instance would still fail to execute it, but the error message would typically indicate a decoding or execution failure, not a missing `yum` command. In this scenario, the script is executing and reaching the `yum` command, so encoding is not the root cause.

The tags prevent user data from executing

Why it fails: EC2 instance tags are metadata key-value pairs that can be used for organization, billing, or automation, but they have no effect on whether UserData scripts execute. AWS documentation and behavior confirm that UserData scripts run during the first boot of the instance, regardless of any tags applied. The only factors that can block UserData execution are cloud-init misconfiguration, AMI-specific settings, or the script itself failing; tags are not one of them.

The AMI uses a different init system than systemd

Why it fails: The AMI's init system (systemd vs. SysVinit vs. Upstart) governs how services are started and managed, but it does not control the availability of the `yum` command. While a non-systemd init system might prevent cloud-init from properly executing as a service, the failure described—where the `yum` command itself cannot be found—is a package-manager absence issue, not an init-system incompatibility. The error would occur regardless of the init system if the underlying OS uses a different package manager.

The Effect should be Deny for this policy to work

Why it fails: Changing Effect to Deny would not make the policy work as intended. The existing Allow with a Condition is the correct structure: when the condition matches, the action is explicitly allowed; when it doesn't, there is no explicit allow, so AWS relies on the default implicit deny. A Deny statement with the same condition would deny only when the condition is true (and still do nothing for the false branch), while an unconditional Deny would block every PutObject regardless of the ACL, which is not the goal.

The resource ARN is incorrect; it should be arn:aws:s3:::my-bucket

Why it fails: The resource ARN arn:aws:s3:::my-bucket/* is correct for object operations such as s3:PutObject. A bucket-level ARN without the /* qualifier is appropriate only for bucket-level actions like s3:ListBucket or s3:GetBucketLocation, not for actions that target individual objects. Since the policy is meant to permit uploading objects, the object ARN with the wildcard path is necessary, and the suggested alternative would actually make the policy invalid for this action.

The user does not have permission to list the bucket

Why it fails: This answer misidentifies the failing action. The request is a PUT Object call, which requires only the s3:PutObject permission; s3:ListBucket is not involved in uploading an individual object. The policy does allow s3:PutObject, but the attached condition requires the x-amz-acl header to be exactly bucket-owner-full-control. Because the user failed to supply that header (or supplied a different value), the condition never became true, so the request was implicitly denied — not because of a missing list permission.

The CodePipeline deployment action uses the wrong cluster.

Why it fails: The deployment action references the cluster in the ECS service definition, and an incorrect cluster name or ARN would cause the CodePipeline action to fail before any tasks are placed. Since the pipeline completed successfully and tasks are running, the cluster reference is demonstrably valid. A cluster mismatch would also surface as a ResourceNotFoundException or service discovery failure, not a database timeout.

The ECS service is not registered with a target group.

Why it fails: If the ECS service had no target group registration, the ALB would be unable to route traffic to the tasks and would return HTTP 503 Service Unavailable before any application code executes. The observed database timeout proves the container received incoming traffic and attempted to make an outbound connection, so the service must be correctly wired to a target group. Moreover, a missing target group registration would cause the deployment to fail health checks, not allow a green deployment.

The database is not available in the same Availability Zone.

Why it fails: An Availability Zone mismatch between the database and the ECS tasks does not produce a connection timeout, because VPC networking permits cross-AZ traffic by default. Even if tasks and the DB are in different AZs, the TCP connection succeeds unless a security group or NACL blocks it, and any added latency would be minimal. Additionally, managed database services like RDS/Aurora replicate across AZs transparently, so an AZ mismatch is not a logical configuration error that would cause this symptom.

The stack update is in progress.

Why it fails: An in-progress update would be surfaced as UPDATE_IN_PROGRESS (or one of the related transitional states like UPDATE_COMPLETE_CLEANUP_IN_PROGRESS), and CloudFormation would still be executing the change set. The terminal status ROLLBACK_COMPLETE shows that the update attempt has already ended, not that it is currently running. This status is reached only after a failed update has been fully reverted, so interpreting it as an ongoing operation misreads the stack lifecycle.

The stack was deleted successfully.

Why it fails: If the stack had been deleted, the terminal status would be DELETE_COMPLETE, and the stack itself would no longer appear in the describe-stacks output. During deletion CloudFormation removes the stack and all its resources, whereas ROLLBACK_COMPLETE means the stack still exists and has been restored to its previous known-good state. A deletion that fails leaves the status DELETE_FAILED, so ROLLBACK_COMPLETE cannot represent a successful deletion.

The stack was created successfully.

Why it fails: A successful creation is always reported as CREATE_COMPLETE; ROLLBACK_COMPLETE is a failure signal, not a success signal. In fact, if a create-stack call fails, CloudFormation rolls back and enters ROLLBACK_COMPLETE, but here the command is update-stack, and the stack already existed and had been updated previously. Because ROLLBACK_COMPLETE only describes the outcome of a failed operation that was reverted, it cannot indicate that the stack was created cleanly.

The encryption key is a KMS key that the role cannot access

Why it fails: The encryption key being a KMS key that the role cannot access is not the cause because the exhibit shows the default S3 encryption key (SSE-S3), not a customer-managed KMS key. SSE-S3 uses an AWS-managed key, so no kms:Decrypt permission is required in the service role. Even if a KMS key were used, CodePipeline would need kms:Decrypt permission, but the error message about missing s3:GetObject is a different, more fundamental issue.

The source type is S3, but the project expects CodeCommit

Why it fails: Source type is not the problem; the pipeline is explicitly configured with S3 as the source provider, and Amazon S3 is a supported source type in CodePipeline. The term 'project' likely refers to the CodeBuild project or pipeline, which does not have an inherent expectation of CodeCommit. Since the source configuration matches the S3 bucket specified, this option misidentifies the cause and does not align with the actual error.

The source location is incorrect

Why it fails: The source location is not incorrect because the error message and exhibit indicate the bucket and object key are properly formatted and the location exists. CodePipeline would not proceed to an IAM-related error if the bucket or key were invalid; it would fail with a 'bucket does not exist' or 'object not found' message. Thus, the problem is not a typo or wrong path, but a permissions gap on the service role.

The AWS_DEFAULT_REGION environment variable is not set in CodeBuild.

Why it fails: CodeBuild automatically sets AWS_DEFAULT_REGION and AWS_REGION in every build container to the region where the project runs, so a missing region is virtually impossible. Even if these were absent, the AWS CLI would attempt to resolve the region from the config file or prompt "You must specify a region," and the actual failure occurs during the ECR authorization call, not before it. Therefore, this is not the root cause.

The buildspec.yml is missing the 'docker login' command.

Why it fails: The buildspec snippet actually contains the `docker login` command, piped from `aws ecr get-login-password`, so this option is factually incorrect. Even if the command were missing, the build would succeed up to that step and only then fail with a "command not found" or a missing step error, not with an authentication error. The failure here is earlier, at the point of retrieving the ECR password, not in the absence of the login invocation.

The Docker daemon is not running on the CodeBuild instance.

Why it fails: CodeBuild's managed images run the Docker daemon as a background process, and the daemon is responsible for accepting `docker login` and build commands; if it were down, the error would be "Cannot connect to the Docker daemon at unix:///var/run/docker.sock" rather than an ECR authorization failure. The command `docker login` with `--password-stdin` does not require the daemon to be running to fail; it fails because the password piped to it was generated by an unauthenticated call to ECR. Hence, the daemon is not the issue.

The Allow statement does not specify the correct pipeline ARN.

Why it fails: The pipeline ARN is correctly specified, so an ARN mismatch is not the cause. Even if the ARN were wrong, the resulting error would indicate a resource not found or not authorized for that specific resource, not the blanket AccessDenied produced by an explicit Deny. Thus, this explanation incorrectly identifies the Allow statement's resource field as the problem.

The policy needs an additional Allow for 'codepipeline:GetPipeline' to start the pipeline.

Why it fails: Starting a pipeline execution requires only the codepipeline:StartPipelineExecution action on the pipeline resource; no additional read permission such as GetPipeline is necessary. The Allow statement already grants the required action, so adding GetPipeline would neither satisfy the missing permission nor override the explicit Deny statement. Therefore, this is not the reason for AccessDenied.

The role does not have permission to pass the policy to the CI/CD system.

Why it fails: The policy is directly attached to the role that the CI/CD system assumes, so there is no 'passing' of the policy to another service. The PassRole permission (iam:PassRole) is only relevant when one service needs to assign a role to another service, which is not happening here. The failure arises from the Deny statement in the same policy, not from any pass-role authorization.