AWS Serverless Application Model (SAM)

35 soru

Tüm türler35 Çoktan seçmeli18 Çoklu seçim17

A developer is configuring a deployment template for a new serverless application using the AWS Serverless Application Model (SAM). The template contains the following partial structure:

yaml
Transform: AWS::Serverless-2016-10-31
Resources:
MyFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src

Which two steps or configurations are required to successfully deploy and run this serverless application? (Select two.)

Geçerli olan tümünü seçin

The template must declare the Transform header at the root level of the template file to instruct CloudFormation on how to process SAM-specific resources.

The local function code located in the './src' directory must be packaged and uploaded to an Amazon S3 bucket prior to deploying the CloudFormation stack.

The template must list the Lambda function resource under the Globals section instead of the Resources section.

The API Gateway event source must be configured with a custom integration rather than a proxy integration to allow SAM to automatically map HTTP header values.

The Lambda function's IAM trust policy must explicitly grant permissions to retrieve runtime configuration secrets from AWS Secrets Manager.

Cevabı ve açıklamayı göster

Cevap: The template must declare the Transform header at the root level of the template file to instruct CloudFormation on how to process SAM-specific resources.; The local function code located in the './src' directory must be packaged and uploaded to an Amazon S3 bucket prior to deploying the CloudFormation stack.

Cevap

The configurations required are: (1) declaring the Transform header at the root level of the template file, and (2) packaging and uploading the local function code in the './src' directory to an Amazon S3 bucket.

The correct answer states that the Transform declaration must be at the root of the template file to instruct CloudFormation how to parse the SAM shorthand syntax, and that local function artifacts in the source directory must be zipped and uploaded to an S3 bucket prior to CloudFormation execution.

Adım Adım Çözüm

Analyze template syntax and transformation requirement.

Identify that the 'Transform: AWS::Serverless-2016-10-31' line is required at the root of the template.

This header informs AWS CloudFormation that it must parse the template using the Serverless transform to expand SAM resources into standard CloudFormation resources.

Analyze code deployment requirements.

Confirm that local files specified by 'CodeUri: ./src' must be packaged.

CloudFormation requires function code to be hosted in an Amazon S3 bucket. The packaging phase zips the local code directory, uploads it, and replaces the local path with the S3 URI.

Anahtar Kavram

AWS SAM templates require a root-level transform declaration to be parsed by AWS CloudFormation, and local deployment artifacts must be packaged and uploaded to S3.

Tahmini Süre:1m 0s

Soru 2Soru →

A developer is attempting to deploy a serverless application using a template file named template.yaml. The file contains the following code:

yaml
Resources:
ProcessOrderFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
PostOrder:
Type: Api
Properties:
Path: /orders
Method: post

When deploying this template directly via AWS CloudFormation, the deployment fails with the error message: `Template format error: Unrecognized resource type: AWS::Serverless::Function`.

Which of the following additions to the template will resolve this error?

Add `Transform: AWS::Serverless-2016-10-31` at the root level of the template.

Add an IAM trust policy that explicitly allows the `apigateway.amazonaws.com` service to assume the execution role of the Lambda function.

Specify the `Integration: AWS_PROXY` property under the `Events` section of the serverless function.

Configure a `Timeout` property under `Globals` to match the execution environment's maximum execution duration.

Cevabı ve açıklamayı göster

Cevap: Add `Transform: AWS::Serverless-2016-10-31` at the root level of the template.

Cevap

To resolve the unrecognized resource type error, the `Transform: AWS::Serverless-2016-10-31` declaration must be added at the root level of the template. This declaration tells AWS CloudFormation to process the template using the AWS SAM translator, which converts serverless-specific resources like `AWS::Serverless::Function` into standard AWS CloudFormation resources.

The template contains an `AWS::Serverless::Function` resource, which is a custom resource type extension provided by the AWS Serverless Application Model (SAM). AWS CloudFormation does not natively recognize this resource type. To enable CloudFormation to parse and translate this template into standard resources, the `Transform: AWS::Serverless-2016-10-31` line must be included at the root level of the template. Adding this declaration resolves the parsing error.

Adım Adım Çözüm

Analyze the error message returned during template deployment.

The error indicates that the resource type `AWS::Serverless::Function` is unrecognized by AWS CloudFormation.

This tells us that the parser is treating the template as standard CloudFormation and does not know how to translate SAM resources.

Check the root level of the template for the required transform declaration.

The template only has a `Resources` block and is missing the `Transform` declaration.

AWS CloudFormation requires a macro to process the SAM template format into standard CloudFormation resources.

Add the transform statement to the template.

Inserting `Transform: AWS::Serverless-2016-10-31` at the root allows CloudFormation to parse the SAM resources.

This macro transforms the serverless resource declarations into their underlying AWS CloudFormation resources (like `AWS::Lambda::Function` and `AWS::IAM::Role`) during deployment.

Anahtar Kavram

AWS SAM templates extend AWS CloudFormation. To deploy SAM resources using CloudFormation, the template must include the `Transform: AWS::Serverless-2016-10-31` declaration. This triggers the CloudFormation transform macro to parse and compile SAM-specific resources into standard CloudFormation resources.

Soru 3Soru →

A developer is using AWS Serverless Application Model (SAM) to deploy a serverless API. The application uses a Lambda function triggered by an API Gateway API (defined as an `Api` event source) to retrieve records from a database. During testing, the API Gateway endpoint returns a 502 Bad Gateway error. The Lambda function logs indicate that it executed successfully and returned the database records, but the integration failed. Additionally, the developer needs to store the database credentials securely and ensure they are rotated automatically.

Which of the following actions should the developer take to resolve the integration error and meet the security requirements? (Select TWO.)

Geçerli olan tümünü seçin

Format the Lambda function's return payload to include the statusCode, headers, and body fields.

Store the database credentials in AWS Secrets Manager and configure automatic rotation for the secret.

Modify the API Gateway integration in the template to use a custom integration, and configure the Lambda function handler to parse the request mapping templates.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString, and enable the built-in Parameter Store automatic rotation feature.

Update the trust policy of the Lambda execution role to allow the API Gateway service principal (apigateway.amazonaws.com) to assume the role.

Cevabı ve açıklamayı göster

Cevap: Format the Lambda function's return payload to include the statusCode, headers, and body fields.; Store the database credentials in AWS Secrets Manager and configure automatic rotation for the secret.

Cevap

Format the Lambda function's return payload to include the statusCode, headers, and body fields, and store the database credentials in AWS Secrets Manager and configure automatic rotation for the secret.

The correct options are to format the Lambda function's return payload with status code, headers, and body fields, and to store the credentials in AWS Secrets Manager with automatic rotation. Because the default SAM Api event source deploys API Gateway with Lambda proxy integration, the Lambda response must adhere to a specific structure. Additionally, Secrets Manager is the correct service to use because it supports native automated credential rotation, whereas Systems Manager Parameter Store does not.

Adım Adım Çözüm

Analyze the 502 Bad Gateway integration error.

The Lambda function executes successfully but the integration fails. Since AWS SAM's default Api event source configures API Gateway Lambda proxy integration, the Lambda function must return the response in a structured format containing the status code, headers, and body.

This determines how to format the Lambda function's response to satisfy API Gateway's proxy integration requirements.

Evaluate the database credential rotation requirement.

AWS Secrets Manager is selected because it natively supports automatic rotation of credentials, unlike AWS Systems Manager Parameter Store which requires custom implementations to achieve rotation.

This identifies the correct AWS service to store and rotate credentials securely.

Anahtar Kavram

AWS SAM templates default to API Gateway Lambda proxy integrations, requiring structured JSON responses from the backend Lambda function, and security credentials requiring rotation should be managed by AWS Secrets Manager.

Soru 4Soru →

A developer is using AWS Serverless Application Model (SAM) to deploy a Lambda function that processes incoming orders via Amazon API Gateway. The developer wants to configure the deployment pipeline to perform a canary deployment, shifting 10% of the traffic to the new version for a 5-minute evaluation period before routing the remaining traffic.

The current `template.yaml` is defined below:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: Deployment template for order processing service

Resources:
ProcessOrderFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
PostOrder:
Type: Api
Properties:
Path: /orders
Method: post

Which of the following modifications must the developer make to the template to enable this gradual deployment strategy? (Select TWO.)

Geçerli olan tümünü seçin

Add the AutoPublishAlias property under the Properties section of ProcessOrderFunction and assign it an alias name.

Add the DeploymentPreference property under the Properties section of ProcessOrderFunction and set the Type to Canary10Percent5Minutes.

Remove the Transform: AWS::Serverless-2016-10-31 declaration from the header to allow standard AWS CloudFormation parsing.

Increase the Timeout property of the ProcessOrderFunction resource to at least 15 minutes to accommodate the 5-minute canary window.

Modify the Events section to change the Api integration type from a Lambda Proxy integration to a custom integration.

Cevabı ve açıklamayı göster

Cevap: Add the AutoPublishAlias property under the Properties section of ProcessOrderFunction and assign it an alias name.; Add the DeploymentPreference property under the Properties section of ProcessOrderFunction and set the Type to Canary10Percent5Minutes.

Cevap

Add the AutoPublishAlias property under the Properties section of ProcessOrderFunction and assign it an alias name; and add the DeploymentPreference property under the Properties section of ProcessOrderFunction and set the Type to Canary10Percent5Minutes.

To configure a canary deployment for an AWS::Serverless::Function, the template must define both the AutoPublishAlias property (to create a Lambda alias pointing to the newly published version) and the DeploymentPreference property (to define the routing policy such as Canary10Percent5Minutes). AWS SAM uses these properties to automatically generate the underlying CodeDeploy resources and configurations needed to route traffic gradually.

Adım Adım Çözüm

Identify the requirement for AWS CodeDeploy in gradual serverless deployments.

Recognize that AWS SAM relies on AWS CodeDeploy to perform canary or linear traffic shifting.

Enabling gradual traffic shifting requires configuring properties that AWS SAM uses to provision the necessary CodeDeploy resources.

Configure function versioning and aliasing in the SAM template.

Identify that AutoPublishAlias must be added to the function properties.

Traffic shifting can only happen between distinct, immutable Lambda function versions referenced by a Lambda alias.

Define the traffic shifting strategy details.

Add the DeploymentPreference object under the function properties, specifying the Type as Canary10Percent5Minutes.

This configuration maps directly to the CodeDeploy deployment configuration that manages the 10% traffic routing and 5-minute evaluation window.

Anahtar Kavram

Configuring gradual deployments (canary/linear) in AWS SAM using AutoPublishAlias and DeploymentPreference properties.

Soru 5Soru →

A developer uses AWS Serverless Application Model (SAM) to deploy a Lambda function that retrieves database credentials from AWS Secrets Manager. The secret is encrypted using a customer managed AWS KMS key. In the SAM template, the developer configures the function's `Policies` property with the `AWSSecretsManagerGetSecretValuePolicy` template, referencing the secret's ARN. The deployment completes successfully. However, when the function runs, it fails with an `AccessDeniedException` during the `GetSecretValue` API call. What is the reason for this runtime failure?

The `AWSSecretsManagerGetSecretValuePolicy` policy template only grants permissions for the `secretsmanager:GetSecretValue` action, meaning the function execution role still lacks permissions to decrypt the secret using the customer managed KMS key.

AWS SAM policy templates do not support AWS Secrets Manager directly, requiring the developer to migrate the database credentials to Systems Manager Parameter Store and use the `SSMParameterReadPolicy` template.

The default execution role generated by AWS SAM does not include a trust policy that allows the AWS Secrets Manager service principal to assume the role to deliver the secret.

The developer did not include the `Transform: AWS::Serverless-2016-10-31` declaration in the template, causing AWS CloudFormation to ignore the SAM policy template and strip all permissions from the IAM execution role.

Cevabı ve açıklamayı göster

Cevap: The `AWSSecretsManagerGetSecretValuePolicy` policy template only grants permissions for the `secretsmanager:GetSecretValue` action, meaning the function execution role still lacks permissions to decrypt the secret using the customer managed KMS key.

Cevap

The Lambda function's execution role lacks explicit decrypt permissions on the customer managed KMS key, as the pre-defined `AWSSecretsManagerGetSecretValuePolicy` SAM policy template only grants permission for the `secretsmanager:GetSecretValue` action.

The correct answer is correct because the built-in AWS SAM policy template `AWSSecretsManagerGetSecretValuePolicy` only grants the Lambda function permission to call `secretsmanager:GetSecretValue` on the specified resource. If the secret is encrypted with a customer managed KMS key (rather than the default AWS-managed key `aws/secretsmanager`), the function's IAM execution role must also be granted explicit `kms:Decrypt` permissions on that KMS key to successfully read the decrypted payload.

Adım Adım Çözüm

Analyze the IAM policy generated by the `AWSSecretsManagerGetSecretValuePolicy` template.

The generated policy grants access to `secretsmanager:GetSecretValue` for the target secret resource.

To verify the scope of the permissions granted to the Lambda function's execution role by default.

Identify the encryption mechanism of the secret.

The secret is encrypted using a customer managed KMS key.

Secrets encrypted with customer managed keys require explicit KMS decrypt permissions for any identity attempting to read them.

Determine why the call fails with AccessDeniedException at runtime.

While the function can access Secrets Manager, the decryption fails because the execution role does not possess the `kms:Decrypt` permission on the customer managed key.

Both Secrets Manager and KMS permissions must be present in the execution role for successful retrieval of KMS-encrypted secrets.

Anahtar Kavram

AWS SAM Policy Templates and KMS Decrypt Permissions

Tahmini Süre:2m 0s

Soru 6Soru →

A developer is deploying a serverless application using AWS SAM. The template file (`template.yaml`) defines several `AWS::Serverless::Function` resources with the `CodeUri` property pointing to local directories (e.g., `./src`). The developer attempts to deploy the template directly using the command `aws cloudformation deploy --template-file template.yaml --stack-name my-stack`. The deployment fails with errors indicating that the template format is invalid because the `AWS::Serverless` resources are not recognized, and the local paths for `CodeUri` cannot be resolved. Which TWO actions must the developer take to resolve these issues and successfully deploy the application?

Geçerli olan tümünü seçin

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file.

Run the `sam package` command to upload the local artifacts to an Amazon S3 bucket and generate a new template file with S3 URIs.

Store the function code in AWS Systems Manager Parameter Store and reference the parameter key in the `CodeUri` property.

Modify the trust policy of the Lambda execution role to allow the `cloudformation.amazonaws.com` service principal to assume the role.

Increase the default Lambda function timeout in the template to 30 seconds to allow the CloudFormation deployment to complete.

Cevabı ve açıklamayı göster

Cevap: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file.; Run the `sam package` command to upload the local artifacts to an Amazon S3 bucket and generate a new template file with S3 URIs.

Cevap

To deploy a SAM application successfully, the developer must add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file to enable SAM syntax translation, and run the `sam package` command to upload local assets to Amazon S3 and produce a packaged template referencing those S3 locations.

The correct options involve adding the `Transform: AWS::Serverless-2016-10-31` declaration to enable the CloudFormation SAM parser, and running the `sam package` command to process local paths and upload code artifacts to Amazon S3. These two steps resolve the validation errors and local file path reference limitations in CloudFormation.

Adım Adım Çözüm

Add the required serverless transform header to the SAM template.

The template now includes `Transform: AWS::Serverless-2016-10-31` at the root level.

Without this declaration, AWS CloudFormation does not recognize SAM resource types like `AWS::Serverless::Function` and fails during parsing.

Run the `sam package` command specifying an Amazon S3 bucket for code storage.

The local artifacts are zipped and uploaded to the specified S3 bucket, and a new template file is generated where the `CodeUri` properties point to the S3 objects.

CloudFormation cannot upload local directory contents directly from the deployment command; packaging resolves local paths to S3 URIs.

Deploy the application using the packaged template file.

The stack is created or updated successfully in AWS CloudFormation.

The packaged template contains standard S3 locations and valid SAM syntax that CloudFormation can translate and execute.

Anahtar Kavram

AWS SAM templates must define the Transform header to be processed, and local files must be packaged and uploaded to Amazon S3 before deploying via CloudFormation.

Soru 7Soru →

A developer uses the AWS Serverless Application Model (SAM) to deploy a serverless application. The template defines an AWS::Serverless::Function resource with an Api event source, as shown in the following snippet:

yaml
Resources:
ProcessOrderFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
CreateOrder:
Type: Api
Properties:
Path: /orders
Method: post

The application deploys successfully. However, when clients send a POST request to /orders, the API Gateway returns a 502 Bad Gateway status code, and the Lambda function execution logs show that the function ran and completed successfully without errors.

Which of the following describes the cause of this issue and the correct resolution?

The Lambda function execution exceeded its default timeout limit because SAM functions default to a timeout of 3 seconds. To resolve this, increase the Timeout property under the resource Properties in the SAM template.

The SAM template is missing the Transform declaration at the root level, causing API Gateway to fail to map the incoming request to the Lambda function. To resolve this, add 'Transform: AWS::Serverless-2016-10-31' to the template.

The default integration type for the SAM Api event is a Lambda proxy integration. The Lambda function returned a plain text string instead of a structured JSON response containing the statusCode and body fields, which API Gateway requires. To resolve this, modify the Lambda function return value to match the expected JSON structure.

The IAM execution role assigned to the Lambda function has an invalid trust policy that does not trust the API Gateway service principal. To resolve this, update the trust policy to allow 'apigateway.amazonaws.com' to assume the role.

Cevabı ve açıklamayı göster

Cevap: The default integration type for the SAM Api event is a Lambda proxy integration. The Lambda function returned a plain text string instead of a structured JSON response containing the statusCode and body fields, which API Gateway requires. To resolve this, modify the Lambda function return value to match the expected JSON structure.

Cevap

The default integration type configured by AWS SAM when using the Api event source is the Lambda proxy integration. Under this model, API Gateway passes the raw request directly to the Lambda function, and expects the Lambda function to return a response matching a specific JSON format (specifically containing 'statusCode' and 'body' fields). If the function returns a raw string or an unsupported format, API Gateway cannot map the response, resulting in a 502 Bad Gateway error. Modifying the Lambda function to return the correct JSON structure resolves the issue.

Adım Adım Çözüm

Analyze the error symptoms and deployment state.

The application deployed successfully, but requests result in a 502 Bad Gateway error, and Lambda logs show successful execution with no runtime exceptions.

This rules out deployment-time issues like missing transforms, and rules out internal Lambda execution errors or timeouts.

Identify the integration type defined by the AWS SAM Api event source.

By default, defining an Api event source under AWS::Serverless::Function sets up an Amazon API Gateway REST API with Lambda Proxy Integration.

Understanding the defaults of AWS SAM configurations helps pinpoint the expectations of the API Gateway integration.

Verify response formatting requirements for Lambda Proxy Integration.

API Gateway Proxy Integration expects the Lambda function output to be a JSON object with at least a 'statusCode' and a 'body' property.

Returning a plain string instead of the structured JSON payload causes API Gateway to fail parsing, leading to a 502 Bad Gateway response.

Anahtar Kavram

AWS SAM defaults to configuring API Gateway Lambda Proxy Integrations for Api events, which requires backend Lambda functions to return a specific JSON response format containing 'statusCode' and 'body'.

Soru 8Soru →

A developer is deploying a serverless backend using AWS SAM. The configuration file `template.yaml` contains the following definition:

yaml
Resources:
ProcessDataFunction:
Type: AWS::Serverless::Function
Properties:
Handler: app.handler
Runtime: python3.12
CodeUri: src/
Events:
GetData:
Type: HttpApi
Properties:
Path: /data
Method: GET

During the deployment process, the CloudFormation stack creation fails with the message `Template format error: Unrecognized resource type: AWS::Serverless::Function`. Additionally, the developer notes that the python handler code currently returns a plain text string `'Success'`, which will cause integration failure when invoked through the API Gateway endpoint.

Which two actions must the developer take to resolve these issues?

Geçerli olan tümünü seçin

Add `Transform: AWS::Serverless-2016-10-31` at the root of the template file.

Modify the python handler to return a dictionary with `statusCode` and `body` keys, where `body` is a JSON-formatted string.

Create a new trust policy for the Lambda execution role allowing the `apigateway.amazonaws.com` service principal to perform `sts:AssumeRole`.

Configure the `Timeout` property of the `AWS::Serverless::Function` resource to 900 seconds to prevent execution timeouts.

Store the response string in the Systems Manager Parameter Store and retrieve it dynamically in the API Gateway integration settings.

Cevabı ve açıklamayı göster

Cevap: Add `Transform: AWS::Serverless-2016-10-31` at the root of the template file.; Modify the python handler to return a dictionary with `statusCode` and `body` keys, where `body` is a JSON-formatted string.

Cevap

The correct actions are to add the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template file, and to update the python handler to return a dictionary with `statusCode` and `body` keys.

Adding the Transform declaration allows the AWS CloudFormation service to parse the serverless resources. Returning a dictionary with the status code and JSON body conforms to the Lambda Proxy integration format required by the API Gateway HTTP API configuration.

Adım Adım Çözüm

Diagnose the CloudFormation parsing failure.

The `Unrecognized resource type: AWS::Serverless::Function` error occurs because CloudFormation does not natively understand the `AWS::Serverless` namespace without the SAM translator. Adding `Transform: AWS::Serverless-2016-10-31` at the template root resolves this.

The Transform declaration instructs CloudFormation to invoke the SAM translator to convert the simplified SAM syntax into standard CloudFormation resources.

Diagnose the API Gateway integration failure.

By default, API Gateway event sources declared on SAM Functions use Lambda Proxy Integration, which expects the Lambda function to return a structured JSON response containing `statusCode` and a string `body`.

If the function returns a raw string, API Gateway cannot map it to an HTTP response, resulting in an integration error (HTTP 502).

Anahtar Kavram

AWS SAM templates must include the Transform declaration to allow CloudFormation to interpret serverless resources, and Lambda functions integrated with API Gateway HTTP APIs must adhere to the Lambda Proxy Integration response format.

Soru 9Soru →

A developer is using AWS SAM to build a serverless application. The application defines a Lambda function that needs to consume messages from an Amazon SQS queue. The developer is writing the `template.yaml` file and wants to ensure that the template is parsed correctly as an AWS SAM template and that the Lambda function is granted only the minimum necessary permissions to poll the queue. Which of the following actions should the developer take in the `template.yaml` file to meet these requirements? (Select TWO).

Geçerli olan tümünü seçin

Include `Transform: AWS::Serverless-2016-10-31` at the root level of the template file.

Add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.

Define a custom IAM trust policy within the function properties that explicitly allows the `sqs.amazonaws.com` service principal to assume the function's execution role.

Add the declaration `AWS::Serverless-2016-10-31` under the `Globals` section of the template.

Configure the function's environment variables to retrieve the SQS queue URL dynamically from AWS Secrets Manager using a dynamic reference.

Cevabı ve açıklamayı göster

Cevap: Include `Transform: AWS::Serverless-2016-10-31` at the root level of the template file.; Add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.

Cevap

The correct actions are to include the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template file and to add the `SQSPollerPolicy` template to the `Policies` property of the `AWS::Serverless::Function` resource.

To successfully deploy an AWS SAM application, the template must include the `Transform` declaration at the root level so that CloudFormation can translate the serverless resources. Additionally, to grant the Lambda function the ability to read from the SQS queue with least privilege, the pre-defined `SQSPollerPolicy` template should be added directly under the function's `Policies` property.

Adım Adım Çözüm

Identify the requirement for AWS SAM template parsing.

Confirm that the `Transform: AWS::Serverless-2016-10-31` header must be included at the top-level root of the template.

Without this declaration, AWS CloudFormation will not trigger the SAM translator, causing deployment to fail when encountering serverless resource types.

Determine the appropriate IAM configuration for SQS integration.

Select the `SQSPollerPolicy` SAM policy template and place it in the function's `Policies` property.

This policy template grants the exact minimum permissions (such as `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `sqs:GetQueueAttributes`) required for the Lambda service to poll the SQS queue.

Anahtar Kavram

AWS SAM template structure requirements and SAM policy templates for IAM permission management.

Soru 10Soru →

A developer is using AWS SAM to deploy a serverless application consisting of an API Gateway endpoint that triggers a Lambda function, which writes data to a DynamoDB table. The template is defined as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
ProcessTransactionFunction:
Type: 'AWS::Serverless::Function'
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
PostTransaction:
Type: Api
Properties:
Path: /transaction
Method: post
Role: !GetAtt LambdaExecutionRole.Arn

LambdaExecutionRole:
Type: 'AWS::IAM::Role'
Properties:
AssumeRolePolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Principal:
Service:
- apigateway.amazonaws.com
Action:
- 'sts:AssumeRole'
Policies:
- PolicyName: DynamoDBWritePolicy
PolicyDocument:
Version: '2012-10-17'
Statement:
- Effect: Allow
Action:
- 'dynamodb:PutItem'
Resource: !GetAtt TransactionTable.Arn

During the deployment process using the AWS SAM CLI, the deployment fails with a parser error indicating that the resource type `AWS::Serverless::Function` is invalid. Additionally, if the parsing error is resolved, the Lambda function will fail to execute due to execution role issues.

Which two modifications must the developer make to ensure the template parses successfully and the Lambda function can be successfully assumed and executed by the AWS Lambda service?

Geçerli olan tümünü seçin

Add Transform: AWS::Serverless-2016-10-31 at the root level of the template.

Update the trust policy of LambdaExecutionRole to list lambda.amazonaws.com as the service principal.

Update the execution policy of the IAM role to include the lambda:InvokeFunction action on the ProcessTransactionFunction resource.

Modify the Lambda function handler code to return a raw text response since the default configuration for the SAM Api event source uses custom integration.

Add a default Timeout property set to 900 seconds under the Globals section to prevent execution context reuse timeouts during deployment validation.

Cevabı ve açıklamayı göster

Cevap: Add Transform: AWS::Serverless-2016-10-31 at the root level of the template.; Update the trust policy of LambdaExecutionRole to list lambda.amazonaws.com as the service principal.

Cevap

To resolve the issues, the developer must add the Transform declaration to the root level of the template, and update the execution role trust policy to list the Lambda service principal.

Adding the Transform header enables the CloudFormation service to parse the AWS SAM syntax. Changing the service principal in the trust policy to lambda.amazonaws.com allows the Lambda service to assume the execution role and run the function.

Adım Adım Çözüm

Analyze the template syntax error.

Identify that the parser failed on 'AWS::Serverless::Function' because the AWS SAM transform macro statement is missing.

Without the Transform declaration, CloudFormation does not recognize resources in the AWS::Serverless namespace.

Analyze the IAM Role trust policy configuration.

Identify that the trust policy lists 'apigateway.amazonaws.com' as the service principal in the Principal section.

The execution role must be assumed by the Lambda service, meaning the service principal must be lambda.amazonaws.com.

Determine the necessary changes.

Formulate the fixes: insert the Transform line and update the service principal in the trust policy.

These changes address both the parsing failure and the runtime execution permission failure.

Anahtar Kavram

AWS SAM templates require the Transform header to compile serverless resources, and Lambda execution roles require the correct trust policy configuration to allow the Lambda service to assume the role.

Soru 11Soru →

A developer is deploying a serverless application using a local AWS Serverless Application Model (SAM) template file named `template.yaml`. The template contains the following definition:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31

Resources:
GetProductFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs20.x
CodeUri: ./src
Events:
GetProduct:
Type: Api
Properties:
Path: /products/{id}
Method: get

The developer attempts to deploy the application directly by executing the following AWS CLI command:

`aws cloudformation deploy --template-file template.yaml --stack-name product-service-dev --capabilities CAPABILITY_IAM`

However, the command fails, indicating that the `CodeUri` property of the `AWS::Serverless::Function` resource must point to an Amazon S3 location.

Which of the following statements identifies the root cause of this error and the correct action to resolve it?

The template has the `Transform: AWS::Serverless-2016-10-31` declaration defined at the root level, but this declaration must be moved under the `Metadata` section of the template so that the CloudFormation service can parse and auto-upload local paths.

CloudFormation cannot natively resolve local directory paths like `./src`. The developer must use `sam deploy` (or execute `aws cloudformation package` followed by `aws cloudformation deploy` using the generated packaged template) to zip and upload the local directory to Amazon S3, replacing the local path with an S3 URI.

The execution role associated with the CloudFormation stack deployment is missing a trust policy allowing the `apigateway.amazonaws.com` service principal to assume the role, preventing CloudFormation from reading from the local path.

The API Gateway integration is configured as a proxy integration, which requires the backend Lambda function to return a structured JSON response containing headers, statusCode, and body to authorize local file access.

Cevabı ve açıklamayı göster

Cevap: CloudFormation cannot natively resolve local directory paths like `./src`. The developer must use `sam deploy` (or execute `aws cloudformation package` followed by `aws cloudformation deploy` using the generated packaged template) to zip and upload the local directory to Amazon S3, replacing the local path with an S3 URI.

Cevap

The correct response explains that CloudFormation cannot directly resolve local file paths. Standard CloudFormation deployments require that all Lambda code references (`CodeUri`) point to an S3 object. To resolve this, the developer must package the application using the AWS SAM CLI (`sam deploy`) or the AWS CLI package command (`aws cloudformation package`), which uploads the local zip file to S3 and returns a template with the updated S3 URLs before deploying.

Adım Adım Çözüm

Analyze the failed deployment command and the error message.

The developer ran `aws cloudformation deploy` directly on a raw template containing `CodeUri: ./src`, and CloudFormation rejected it because it expects an S3 URL.

CloudFormation runs on AWS servers and has no direct access to the developer's local hard drive to retrieve `./src` during deployment.

Determine how local artifacts are prepared for AWS SAM deployments.

Local code directories must be compressed into a ZIP file, uploaded to an S3 bucket, and the template reference must be replaced with the S3 URI.

This artifact packaging step must occur prior to sending the template to the CloudFormation API.

Select the correct tool or sequence of commands to perform this preparation.

Using the AWS SAM CLI (`sam deploy` or `sam package`) or AWS CLI (`aws cloudformation package`) compiles and uploads local files, producing a deployable template.

These tools automate the packaging workflow and correctly rewrite local paths to S3 references before invoking CloudFormation deploy.

Anahtar Kavram

Local Artifact Packaging in AWS Serverless Application Model (SAM) Deployments

Tahmini Süre:3m 0s

Soru 12Soru →

An operations team writes a CloudFormation template containing an AWS::Serverless::Function resource. When they attempt to deploy this template using the AWS CLI, CloudFormation returns an error stating that the resource type is invalid or unsupported. What is the root cause of this deployment failure?

The template specifies a Lambda custom integration instead of a Lambda proxy integration.

The Lambda function configuration defines an execution timeout parameter that exceeds the 15-minute maximum limit.

The template does not include the required Transform declaration to invoke the AWS Serverless Application Model parser.

The IAM execution role's trust policy does not list the Lambda service principal as a trusted entity.

Cevabı ve açıklamayı göster

Cevap: The template does not include the required Transform declaration to invoke the AWS Serverless Application Model parser.

Cevap

The template does not include the required Transform declaration to invoke the AWS Serverless Application Model parser.

The correct answer is correct because AWS CloudFormation requires the Transform declaration (specifically Transform: AWS::Serverless-2016-10-31) at the root of the template. Without this declaration, CloudFormation does not recognize or parse custom resource types like AWS::Serverless::Function, resulting in an invalid resource type error.

Adım Adım Çözüm

Identify the resource types declared in the template.

The template contains the resource type AWS::Serverless::Function.

AWS::Serverless::Function is a custom resource type defined by the AWS Serverless Application Model (SAM).

Determine how CloudFormation processes SAM resource types.

CloudFormation requires the Transform: AWS::Serverless-2016-10-31 declaration to translate these resource types.

Without the Transform declaration, CloudFormation treats the template as standard CloudFormation and does not recognize the AWS::Serverless namespace.

Diagnose the error message indicating the resource type is invalid.

The lack of the Transform header causes CloudFormation to reject AWS::Serverless::Function.

Adding the Transform declaration resolves this issue by invoking the SAM translator before processing the resources.

Anahtar Kavram

AWS SAM templates require a Transform declaration (Transform: AWS::Serverless-2016-10-31) at the root level so that CloudFormation can translate serverless resources into standard CloudFormation resources.

Soru 13Soru →

A cloud engineering team is migrating a legacy payment service to a serverless architecture on AWS. To ensure safe deployments, they intend to implement a canary rollout where $10\%$ of traffic is shifted to the new version for $10$ minutes before the remaining traffic is cut over. They write the following AWS SAM template:

yaml
Transform: AWS::Serverless-2016-10-31

Resources:
ProcessPaymentFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./payment
DeploymentPreference:
Type: Canary10Percent10Minutes

After deploying the template, the team observes that the application traffic shifts to the new function version immediately, completely bypassing the $10$ -minute canary phase.

What is the root cause of this behavior?

The AutoPublishAlias property is omitted from the function properties, preventing AWS SAM from generating the Lambda alias and CodeDeploy resources required for traffic shifting.

The IAM role assigned to the function lacks a trust relationship allowing the AWS CodeDeploy service principal to assume it.

The execution timeout of the function is set to a value shorter than the

10

-minute canary window, causing the deployment to fail back to All-at-Once routing.

The Canary10Percent10Minutes deployment configuration is exclusive to Amazon ECS task sets and cannot be applied to serverless functions.

Cevabı ve açıklamayı göster

Cevap: The AutoPublishAlias property is omitted from the function properties, preventing AWS SAM from generating the Lambda alias and CodeDeploy resources required for traffic shifting.

Cevap

The AutoPublishAlias property is omitted from the function properties, which prevents AWS SAM from generating the Lambda alias and AWS CodeDeploy resources required for gradual traffic shifting.

The correct answer is correct because AWS SAM requires the AutoPublishAlias property to be defined in order to set up gradual deployments. AutoPublishAlias instructs SAM to publish new versions of the function and create a Lambda alias pointing to them. CodeDeploy shifts traffic between these versions on the alias. If AutoPublishAlias is omitted, SAM will update the function directly, resulting in an immediate traffic shift.

Adım Adım Çözüm

Analyze how AWS SAM implements gradual deployment preferences using AWS CodeDeploy under the hood.

Identified that AWS CodeDeploy requires a specific target Lambda alias to shift traffic between two underlying Lambda function versions.

Traffic routing cannot occur directly on the function's static ARN or the $LATEST version.

Examine the provided template properties for the AWS::Serverless::Function resource.

Observed that the template defines DeploymentPreference but lacks the AutoPublishAlias property under Properties.

Checking if all required properties are declared to allow SAM to synthesize the CodeDeploy resources.

Determine the outcome of omitting AutoPublishAlias during the CloudFormation transformation phase.

Without AutoPublishAlias, AWS SAM does not generate the Lambda alias resource or the CodeDeploy deployment group, leading to direct updates on $LATEST and causing traffic to shift immediately.

Explaining the root cause of the immediate traffic cutover.

Anahtar Kavram

AWS SAM Gradual Lambda Deployments with CodeDeploy and AutoPublishAlias

Tahmini Süre:2m 0s

Soru 14Soru →

A developer is creating an AWS Serverless Application Model (SAM) template to deploy a Lambda function that is triggered by an API Gateway endpoint. Which two template configurations or declarations are required to successfully define the serverless function and its API Gateway trigger?

Geçerli olan tümünü seçin

Include the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template

Define an `Events` property of type `Api` under the `AWS::Serverless::Function` resource

Declare `AWS::Serverless-2016-10-31` as the value for the `AWSTemplateFormatVersion` property

Configure a custom integration mapping template to manually structure the HTTP request payload for the API Gateway endpoint

Configure the trust policy of the Lambda execution role to allow the API Gateway principal (`apigateway.amazonaws.com`) to assume the role

Cevabı ve açıklamayı göster

Cevap: Include the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template; Define an `Events` property of type `Api` under the `AWS::Serverless::Function` resource

Cevap

To configure the serverless function and its API Gateway trigger, the developer must include the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template and define an `Events` property of type `Api` under the `AWS::Serverless::Function` resource.

The correct configurations are including the `Transform: AWS::Serverless-2016-10-31` declaration at the root of the template to instruct CloudFormation to evaluate the SAM syntax, and defining an `Events` property of type `Api` under the `AWS::Serverless::Function` resource to set up the API Gateway trigger.

Adım Adım Çözüm

Identify the required header declaration for AWS SAM templates.

Adding `Transform: AWS::Serverless-2016-10-31` instructs CloudFormation to parse the template using the SAM engine.

Without the Transform declaration, CloudFormation fails to recognize shorthand SAM resource types like AWS::Serverless::Function.

Configure the event source to trigger the Lambda function.

Adding an `Events` property with an `Api` type under the function resource establishes the API Gateway connection.

This automatically creates and links the API Gateway resource to the function with sensible default proxy configurations.

Anahtar Kavram

AWS Serverless Application Model (SAM) Template Structure

Soru 15Soru →

A developer is deploying a serverless application using AWS SAM. During the deployment process, AWS CloudFormation returns a validation error stating that the resource type 'AWS::Serverless::Function' could not be found or is invalid. Which of the following is the most likely cause of this error?

The template is missing the required Transform declaration specifying the AWS::Serverless-2016-10-31 transform.

The Lambda function's execution role has a misconfigured trust policy that prevents AWS CloudFormation from assuming the role.

The Lambda function is configured with a timeout value that exceeds the maximum limit allowed for serverless function resources.

The template specifies a Lambda proxy integration when it should be configured as a Lambda custom integration.

Cevabı ve açıklamayı göster

Cevap: The template is missing the required Transform declaration specifying the AWS::Serverless-2016-10-31 transform.

Cevap

The template is missing the required Transform declaration specifying the AWS::Serverless-2016-10-31 transform.

The correct answer is correct because AWS SAM is an extension of AWS CloudFormation. In order for CloudFormation to recognize and parse SAM-specific resource types like AWS::Serverless::Function, the template must include the 'Transform: AWS::Serverless-2016-10-31' declaration. This declaration tells CloudFormation to run the macro that translates the SAM template into standard CloudFormation resources.

Adım Adım Çözüm

Analyze the CloudFormation error message.

The error indicates that the resource type 'AWS::Serverless::Function' is unrecognized or invalid.

This error occurs because CloudFormation does not natively support the AWS::Serverless namespace without a translator.

Identify the mechanism that enables CloudFormation to parse SAM resources.

The template must contain the 'Transform: AWS::Serverless-2016-10-31' declaration.

The Transform declaration instructs CloudFormation to invoke the SAM transform macro, which translates SAM-specific resources into standard CloudFormation resources during deployment.

Anahtar Kavram

AWS SAM templates must include the Transform declaration to translate serverless resources into standard CloudFormation resources.

Soru 16Soru →

A developer is writing an AWS Serverless Application Model (SAM) template to deploy a Lambda function that handles API requests. The developer wants to apply a default timeout of 10 seconds to all functions and ensure that the template is parsed correctly by AWS CloudFormation as a SAM template.

yaml
AWSTemplateFormatVersion: '2010-09-09'
# [Configuration 1]

Globals:
# [Configuration 2]

Resources:
ProcessRequestFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: src/
Handler: index.handler
Runtime: nodejs18.x

Which two configuration steps must the developer take to complete the template?

Geçerli olan tümünü seçin

Declare `Transform: AWS::Serverless-2016-10-31` at the root level of the template

Define `Function:` followed by `Timeout: 10` inside the `Globals` section

Declare `Transform: AWS::CloudFormation::Serverless` at the root level of the template

Define `Parameters:` followed by `DefaultTimeout: 10` inside the `Globals` section

Define `Role:` followed by `AssumeRolePolicyDocument: Timeout: 10` inside the `Globals` section

Cevabı ve açıklamayı göster

Cevap: Declare `Transform: AWS::Serverless-2016-10-31` at the root level of the template; Define `Function:` followed by `Timeout: 10` inside the `Globals` section

Cevap

The developer must declare the correct SAM transform at the root level of the template and specify the function timeout under the Globals section.

To complete the AWS SAM template, the template must include the correct `Transform` header at the root level to instruct CloudFormation to process it using the SAM translator, and the `Globals` section must define the `Timeout` under `Function` to apply it to all functions in the template.

Adım Adım Çözüm

Identify the required header to enable AWS SAM parsing in CloudFormation.

The root of the template must include the `Transform: AWS::Serverless-2016-10-31` declaration.

Without the correct Transform header, AWS CloudFormation will fail to recognize SAM-specific resources such as AWS::Serverless::Function.

Configure the global default properties for all Lambda functions defined in the template.

Under the `Globals` section, add a `Function` block containing `Timeout: 10`.

The `Globals` section allows properties common to multiple resources, like function timeouts, to be defined once and applied to all instances of that resource type.

Anahtar Kavram

AWS Serverless Application Model (SAM) templates require a specific Transform header to be processed by CloudFormation, and support a Globals section to define shared resource properties.

Soru 17Soru →

A developer is deploying a serverless application using AWS SAM. The application features a Lambda function triggered by an API Gateway HTTP API. After using the AWS SAM CLI to package and deploy the application, the developer observes two issues:
1. The CloudFormation stack deployment fails with an error indicating that the Lambda service is unauthorized to assume the execution role associated with the function.
2. After manual role adjustment, a test request to the API Gateway endpoint fails with a 502 Bad Gateway error, even though the Lambda function executes successfully without code exceptions.

Which TWO actions should the developer take to resolve these issues?

Geçerli olan tümünü seçin

Modify the trust policy of the IAM execution role to allow the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.

Ensure the Lambda function returns a structured JSON payload containing the statusCode and body keys to match the API Gateway Lambda proxy integration requirements.

Add the Transform: AWS::Serverless-2016-10-31 declaration inside the IAM execution role's trust policy statements.

Increase the function's Timeout parameter in the Globals section of the template.yaml file to 900 seconds.

Replace the API Gateway event source definition with an AWS Systems Manager Parameter Store dynamic reference in the template.

Cevabı ve açıklamayı göster

Cevap: Modify the trust policy of the IAM execution role to allow the lambda.amazonaws.com service principal to perform the sts:AssumeRole action.; Ensure the Lambda function returns a structured JSON payload containing the statusCode and body keys to match the API Gateway Lambda proxy integration requirements.

Cevap

To resolve the issues, the developer must modify the trust policy of the IAM execution role to allow the lambda.amazonaws.com service principal to assume the role, and ensure the Lambda function returns a structured JSON payload containing the statusCode and body keys to match API Gateway Lambda proxy integration requirements.

The correct configurations directly address the two distinct issues. First, the IAM execution role's trust policy must explicitly permit the 'lambda.amazonaws.com' service principal to assume the role via 'sts:AssumeRole'. Second, when using Lambda proxy integration with API Gateway, the Lambda function must return a JSON response containing 'statusCode' and a stringified 'body' for API Gateway to parse the integration response successfully without returning a 502 Bad Gateway error.

Adım Adım Çözüm

Analyze the CloudFormation error regarding role authorization.

Identify that the IAM execution role lacks a trust relationship (assume role policy) allowing the Lambda service to assume it.

Without a valid trust policy trusting lambda.amazonaws.com, the Lambda service cannot assume the role to run the code.

Analyze the API Gateway 502 Bad Gateway error.

Identify that the Lambda function, under Lambda proxy integration, must return a specific schema containing 'statusCode' and 'body'.

API Gateway requires this structured response to construct the HTTP response; returning arbitrary JSON structures causes a 502 error.

Formulate correct configuration adjustments.

Update the execution role's trust policy and modify the function code to return the required JSON response structure.

This fixes both the deployment-time trust issue and the execution-time integration format issue.

Anahtar Kavram

AWS SAM resources rely on correctly configured IAM service trust policies for function execution, and API Gateway Lambda proxy integrations demand a strict return payload contract from the backend Lambda function.

Tahmini Süre:2m 30s

Soru 18Soru →

An engineering team is developing a serverless application using the AWS Serverless Application Model (SAM). The team wants to define a default timeout of 15 seconds that automatically applies to all Lambda functions declared in the template, rather than specifying the timeout property individually for each function resource. Which of the following approaches should the team use to meet this requirement?

Declare a Globals section at the root level of the template with a Function property containing Timeout: 15.

Omit the Transform header from the template and define a Globals section containing the Timeout property directly under the Resources block.

Implement an initialization script within the Lambda handler code that dynamically adjusts the execution context timeout during a cold start.

Specify the timeout value inside the Statement block of the IAM trust policy associated with the Lambda execution role.

Cevabı ve açıklamayı göster

Cevap: Declare a Globals section at the root level of the template with a Function property containing Timeout: 15.

Cevap

Declare a Globals section at the root level of the template with a Function property containing Timeout: 15.

Declaring the configuration under the Globals section at the root level of the template using the Function property allows the AWS SAM translator to apply that property (Timeout: 15) to all serverless functions in the template.

Adım Adım Çözüm

Identify the AWS SAM feature used to define common configurations across resources.

The Globals section of an AWS SAM template allows developers to define common configuration settings for supported resources like Functions, APIs, and SimpleTables.

Using Globals reduces template redundancy and enforces consistent configurations.

Determine the correct structure for the Globals section to define Lambda timeouts.

The Globals section must be defined at the root level (same level as Transform and Resources) and contain a Function block with properties like Timeout.

This syntax tells the SAM translator to inject these properties into all AWS::Serverless::Function resources during deployment.

Anahtar Kavram

AWS SAM Globals Section

Soru 19Soru →

A developer is deploying a serverless application using AWS SAM. The developer needs to deploy a Lambda function that retrieves a database credential from AWS Secrets Manager. The developer writes the following template (`template.yaml`):

yaml
Resources:
DBSecret:
Type: AWS::SecretsManager::Secret
Properties:
Name: my-db-secret
SecretString: '{"password":"mypassword"}'

RetrieveSecretFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Policies:
- AWSSecretsManagerGetSecretValuePolicy:
SecretArn: !Ref DBSecret
Environment:
Variables:
SECRET_NAME: !Ref DBSecret

When attempting to deploy this template using the AWS CLI `aws cloudformation deploy` command, the deployment fails with the error: `Template format error: Unrecognized resource type: AWS::Serverless::Function`. Additionally, the Lambda function code is incorrectly configured to retrieve the database credential using the Systems Manager Parameter Store SDK API client.

Which two actions must the developer take to resolve the deployment failure and ensure the Lambda function can retrieve the database credential?

Geçerli olan tümünü seçin

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.

Modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.

Add a trust relationship policy to the Lambda execution role that explicitly trusts the Secrets Manager service principal (`secretsmanager.amazonaws.com`).

Use the Systems Manager Parameter Store client in the Lambda function code, as Secrets Manager automatically replicates all credentials to Parameter Store by default.

Replace the `AWS::Serverless::Function` resource type with `AWS::Lambda::Function` and remove the `CodeUri` property.

Cevabı ve açıklamayı göster

Cevap: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.; Modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.

Cevap

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template, and modify the Lambda function code to use the AWS Secrets Manager API client (such as calling `GetSecretValue`) to retrieve the credential.

To successfully deploy an AWS SAM template, the `Transform: AWS::Serverless-2016-10-31` declaration must be present at the root level of the template so that AWS CloudFormation can use the serverless transform macro to compile the resources. Furthermore, the Lambda function must call the correct service API (AWS Secrets Manager client's `GetSecretValue`) since the resource is defined as `AWS::SecretsManager::Secret` and the two services do not replicate data between each other automatically.

Adım Adım Çözüm

Add the Transform header to the AWS SAM template.

The template now contains `Transform: AWS::Serverless-2016-10-31` at the root level, allowing AWS CloudFormation to invoke the SAM transform to compile serverless resources.

Without this declaration, CloudFormation does not recognize AWS SAM resource types like `AWS::Serverless::Function`.

Ensure the Lambda execution role has correct permissions.

The execution role is provisioned with Secrets Manager access using the `AWSSecretsManagerGetSecretValuePolicy` SAM policy template.

The Lambda function needs permission to fetch the secret value.

Update the Lambda function code to use the Secrets Manager SDK client.

The code calls `GetSecretValue` from the AWS Secrets Manager client instead of querying Systems Manager Parameter Store.

SSM Parameter Store and Secrets Manager are distinct services, and the credential is saved as a Secrets Manager resource.

Anahtar Kavram

AWS SAM Template Structure and AWS Secrets Manager Integration

Soru 20Soru →

A developer writes an AWS Serverless Application Model (SAM) template to deploy a Lambda function that reads objects from an Amazon S3 bucket. The template is configured as follows:

yaml
AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Resources:
ProcessUploadsFunction:
Type: AWS::Serverless::Function
Properties:
CodeUri: ./src
Handler: index.handler
Runtime: nodejs18.x
Policies:
- S3ReadPolicy

When executing `sam deploy`, the deployment fails with a CloudFormation template validation or parsing error. Which of the following describes the root cause of this deployment failure and the correct resolution?

The S3ReadPolicy template requires a parameter. The developer must specify the target bucket name by structuring the policy as an object with the BucketName property.

The template lacks the required Transform declaration at the root level, causing CloudFormation to fail to parse serverless resources.

The execution role for the function lacks a trust relationship policy. The developer must manually configure an IAM trust policy to trust the Lambda service.

The function lacks credentials to read from the bucket. The developer must retrieve the credentials using a Systems Manager Parameter Store dynamic reference.

Cevabı ve açıklamayı göster

Cevap: The S3ReadPolicy template requires a parameter. The developer must specify the target bucket name by structuring the policy as an object with the BucketName property.

Cevap

The S3ReadPolicy template requires a parameter, meaning the developer must specify the target bucket name by structuring the policy as an object with the BucketName property.

AWS SAM policy templates allow developers to easily scope permissions for Lambda functions. However, many policy templates (such as `S3ReadPolicy`) require parameters to be explicitly defined. Specifying the policy template name as a string element under the `Policies` list is invalid when parameters are required. The correct approach is to define it as an object with the required parameters (e.g., `S3ReadPolicy` mapped to a nested `BucketName` property).

Adım Adım Çözüm

Examine the Policies property configuration in the SAM template.

The template defines the policy as a string element in a list: `- S3ReadPolicy`.

To identify why the validation or parsing error occurred during deployment.

Review the requirements for the AWS SAM S3ReadPolicy template.

The S3ReadPolicy requires the `BucketName` parameter to scope the read permissions to a specific S3 bucket.

To determine whether the policy template requires arguments or can be used as a simple string.

Reformat the policy definition to supply the required parameter.

Change the policy definition to a key-value object containing the policy template name and the bucket reference.

To satisfy the parameter validation requirements of the SAM translator.

Anahtar Kavram

AWS SAM Policy Templates Parameter Requirements

Sayfa 1 / 2Sonraki

AWS Serverless Application Model (SAM)

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram