SOA-C02 Deployment, Provisioning, and Automation Practice Question
A company is using AWS CloudFormation to deploy a stack that includes an Amazon RDS DB instance. The database password is stored in AWS Secrets Manager. The CloudFormation template references the secret using a dynamic reference. However, the stack creation fails with an error that the secret cannot be retrieved. What is the most likely cause?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The CloudFormation service role lacks permissions to read the secret.
To use dynamic references, the CloudFormation service role must have permission to read the secret. The stack name and parameters are not related to secret retrieval. The secret must be in the same region. The template syntax might be incorrect, but the most common issue is missing permissions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The secret is in a different AWS Region.
Why it's wrong here
Secret Manager dynamic references in CloudFormation resolve against the same Region where the stack is deployed. The AWS::CloudFormation::Stack resource does not support cross-Region lookups for secrets, so a secret in a different Region would not be found by the 'resolve:secretsmanager' reference. Instead of a retrieval failure, you would typically see an error that the secret ID does not exist in this Region, not a generic 'cannot be retrieved' message.
- ✗
The stack name does not match the secret name.
Why it's wrong here
The stack name is a user-defined identifier for the CloudFormation stack and has no relationship to the logical ID, physical ID, or name of a Secrets Manager secret. Dynamic references use the secret's name, ARN, or partial ARN to locate the resource, not the stack name. Even if the names are identical, this would not cause a retrieval error; the error stems from authorization or resource existence, not naming congruence.
- ✗
The template uses the wrong dynamic reference syntax.
Why it's wrong here
Invalid dynamic reference syntax usually triggers a template validation error before stack operations begin, such as 'Template format error: Unsupported resource property' or 'Template contains unresolved dynamic references.' The error message 'cannot be retrieved' is emitted during the actual resolution or deployment phase, indicating that CloudFormation successfully parsed the syntax but failed to obtain the secret value. Thus, while a malformed reference is possible, the described error points more strongly to a permissions problem.
- ✓
The CloudFormation service role lacks permissions to read the secret.
Why this is correct
When a CloudFormation stack operation uses a service role, all AWS API calls, including reading secrets, are made using that role's credentials. The role must be granted the 'secretsmanager:GetSecretValue' action and, if the secret uses a customer-managed KMS key, the 'kms:Decrypt' permission as well. Without these permissions, CloudFormation is denied access to the secret and returns an error that the secret cannot be retrieved, even though the secret exists and the reference syntax is valid.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SOA-C02 question from scratch — 1,169 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SOA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SOA-C02 exam.