Examkin

Question

Difficulty: MediumAWS Serverless Application Model (SAM)

An operations team is migrating a legacy provisioning stack to a serverless model. A team member creates a new template file containing an `AWS::Serverless::Function` resource:

yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
RetrieveInventoryFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs20.x
CodeUri: ./src
Environment:
Variables:
DB_PASSWORD: '{{resolve:ssm-secure:InventoryDBPassword}}'

The database password requires automated rotation every 30 days. When attempting to create the stack, AWS CloudFormation fails with a validation error stating that the `AWS::Serverless::Function` resource type is unrecognized.

Which TWO actions should the team take to successfully deploy the template and retrieve the database credentials securely?

  1. Add `Transform: AWS::Serverless-2016-10-31` at the root of the template file.Answer
  2. Store the database password in AWS Secrets Manager and reference it using `{{resolve:secretsmanager:InventoryDBPassword}}` in the environment variables.Answer
  3. C
    Add `Transform: AWS::Serverless-2010-09-09` at the root of the template file.
  4. D
    Keep the password in Systems Manager Parameter Store and write a custom script using AWS EventBridge to rotate the parameter.
  5. E
    Set the `Timeout` property of the `AWS::Serverless::Function` resource to `0` to ensure retrieval requests never time out.

Answer

Add the AWS SAM transform header `Transform: AWS::Serverless-2016-10-31` to the template, and store the password in AWS Secrets Manager, referencing it via the secretsmanager dynamic reference.
To fix the unrecognized resource error, the template must include the `Transform: AWS::Serverless-2016-10-31` declaration. Additionally, credentials requiring automated rotation should be stored in AWS Secrets Manager and referenced using the `secretsmanager` dynamic reference syntax.

Step-by-Step Solution

1
Add the SAM transform declaration to the template.
The resource `AWS::Serverless::Function` is recognized and compiled correctly by AWS CloudFormation.
The SAM transform tells CloudFormation to translate serverless resource definitions into standard CloudFormation resources during deployment.
2
Change the credential store from Systems Manager Parameter Store to AWS Secrets Manager.
The password is stored in a service that natively supports automated rotation every 30 days.
Parameter Store does not natively support automated scheduled rotation of credentials, which is a key requirement of Secrets Manager.
3
Update the reference in the template's environment variables to use `{{resolve:secretsmanager:InventoryDBPassword}}`.
The database password is dynamically retrieved securely at runtime.
Using the secretsmanager dynamic reference ensures the password is not hardcoded in the template while meeting security standards.

Key Concept

AWS SAM Template Anatomy & Credentials Rotation
Estimated Time:1m 30s
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic