AWS DevOps DevOps Automation Tools & Scripting Techniques 3 — Questions and Answers
Question 1: A DevOps team stores Ansible playbooks in CodeCommit and wants to auto-trigger playbook runs on every commit. What is the most straightforward AWS-native approach?
- Use CloudWatch Events to trigger an EC2 instance that runs the playbook
- Configure a CodePipeline with a CodeBuild action that runs ansible-playbook (Correct answer)
- Schedule a Lambda function to poll CodeCommit every minute
- Use AWS OpsWorks to detect commits and execute playbooks
Correct answer: Configure a CodePipeline with a CodeBuild action that runs ansible-playbook
CodePipeline with a CodeBuild action is the native CI/CD approach: CodeCommit triggers the pipeline, and the CodeBuild stage executes the ansible-playbook command.
Question 2: Which AWS service provides a managed Terraform state backend, allowing teams to store and lock state files without managing an S3+DynamoDB setup manually?
- AWS CodeArtifact
- AWS Systems Manager State Manager
- Terraform Cloud (not AWS-native) (Correct answer)
- AWS Service Catalog
Correct answer: Terraform Cloud (not AWS-native)
Terraform Cloud provides a managed remote state backend with locking, though it is HashiCorp's service rather than a native AWS service; on AWS the standard approach is S3+DynamoDB.
Question 3: In an AWS CodeBuild buildspec.yml, which phase should be used to install operating system packages and language runtimes before the build begins?
- pre_build
- install (Correct answer)
- build
- post_build
Correct answer: install
The 'install' phase is specifically designed for installing packages, runtimes, and build tools before any build logic runs.
Question 4: A script needs to assume an IAM cross-account role and then call S3 APIs using the temporary credentials. Which boto3 call sequence is correct?
- sts.get_session_token() → s3 client with returned credentials
- sts.assume_role() → extract Credentials → s3 client with AccessKeyId/SecretAccessKey/SessionToken (Correct answer)
- iam.create_role() → s3 client with new role ARN
- s3.put_bucket_policy() with cross-account ARN directly
Correct answer: sts.assume_role() → extract Credentials → s3 client with AccessKeyId/SecretAccessKey/SessionToken
sts.assume_role() returns temporary credentials (AccessKeyId, SecretAccessKey, SessionToken) that must be explicitly passed when creating the S3 client.
Question 5: A CloudFormation stack update is failing because a resource replacement would cause data loss. Which CloudFormation stack policy action prevents accidental replacement of a production database?
- Set DeletionPolicy: Retain on the resource
- Apply a stack policy that denies Replace actions on the database resource (Correct answer)
- Enable termination protection on the stack
- Use a change set and add a manual approval step
Correct answer: Apply a stack policy that denies Replace actions on the database resource
A stack policy with an explicit Deny on the Replace action for specific resources prevents CloudFormation from replacing those resources during updates.
Question 6: Which Systems Manager document type is designed to run Ansible playbooks directly on managed EC2 instances without installing Jenkins or CodeBuild?
- AWS-RunShellScript
- AWS-RunAnsiblePlaybook
- AWS-ApplyAnsiblePlaybooks (Correct answer)
- AWS-ConfigureAnsible
Correct answer: AWS-ApplyAnsiblePlaybooks
AWS-ApplyAnsiblePlaybooks is the official SSM document that downloads and executes Ansible playbooks on managed instances via Run Command.
Question 7: A DevOps engineer wants to enforce that all EC2 instances in an AWS account must be launched with an approved AMI. Which AWS service enforces this at resource-creation time?
- AWS Config with a remediation action
- AWS Service Control Policies (SCPs) (Correct answer)
- AWS Systems Manager Patch Manager
- AWS CloudTrail with Lambda triggers
Correct answer: AWS Service Control Policies (SCPs)
SCPs applied at the AWS Organizations level can deny ec2:RunInstances requests that don't specify approved AMI IDs, blocking non-compliant launches before they occur.
AWS DevOps DevOps Automation Tools & Scripting Techniques 3
A DevOps team stores Ansible playbooks in CodeCommit and wants to auto-trigger playbook runs on every commit.
What is the most straightforward AWS-native approach?