Examkin

Question

Difficulty: HardAWS Serverless Application Model (SAM)

A developer is deploying a serverless application using AWS SAM. The developer needs to deploy a Lambda function that retrieves a database credential from AWS Secrets Manager. The developer writes the following template (`template.yaml`):

yaml
Resources:
DBSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: my-db-secret
SecretString: '{"password":"mypassword"}'

RetrieveSecretFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Policies:
- AWSSecretsManagerGetSecretValuePolicy:
SecretArn: !Ref DBSecret
Environment:
Variables:
SECRET_NAME: !Ref DBSecret

When attempting to deploy this template using the AWS CLI `aws cloudformation deploy` command, the deployment fails with the error: `Template format error: Unrecognized resource type: AWS::Serverless::Function`. Additionally, the Lambda function code is incorrectly configured to retrieve the database credential using the Systems Manager Parameter Store SDK API client.

Which two actions must the developer take to resolve the deployment failure and ensure the Lambda function can retrieve the database credential?

  1. Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.Answer
  2. Modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.Answer
  3. C
    Add a trust relationship policy to the Lambda execution role that explicitly trusts the Secrets Manager service principal (`secretsmanager.amazonaws.com`).
  4. D
    Use the Systems Manager Parameter Store client in the Lambda function code, as Secrets Manager automatically replicates all credentials to Parameter Store by default.
  5. E
    Replace the `AWS::Serverless::Function` resource type with `AWS::Lambda::Function` and remove the `CodeUri` property.

Answer

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template, and modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.
To successfully deploy an AWS SAM template, the `Transform: AWS::Serverless-2016-10-31` declaration must be present at the root level of the template so that AWS CloudFormation can use the serverless transform macro to compile the resources. Furthermore, the Lambda function must call the correct service API (AWS Secrets Manager client's `GetSecretValue`) since the resource is defined as `AWS::SecretsManager::Secret` and the two services do not replicate data between each other automatically.

Step-by-Step Solution

1
Add the Transform header to the AWS SAM template.
The template now contains `Transform: AWS::Serverless-2016-10-31` at the root level, allowing AWS CloudFormation to invoke the SAM transform to compile serverless resources.
Without this declaration, CloudFormation does not recognize AWS SAM resource types like `AWS::Serverless::Function`.
2
Ensure the Lambda execution role has correct permissions.
The execution role is provisioned with Secrets Manager access using the `AWSSecretsManagerGetSecretValuePolicy` SAM policy template.
The Lambda function needs permission to fetch the secret value.
3
Update the Lambda function code to use the Secrets Manager SDK client.
The code calls `GetSecretValue` from the AWS Secrets Manager client instead of querying Systems Manager Parameter Store.
SSM Parameter Store and Secrets Manager are distinct services, and the credential is saved as a Secrets Manager resource.

Key Concept

AWS SAM Template Structure and AWS Secrets Manager Integration
Rate this question

Topics

AWS Serverless Application Model (SAM)

More questions from this topic