DOP-C02 Practice Question 33: Custom Resource Response URL
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 4 · question 3 of 10
A CloudFormation template registers each new environment with a third-party monitoring SaaS that has no CloudFormation resource type, and deregisters it when the stack is deleted. An engineer implemented this with a Custom::MonitoringRegistration resource backed by an AWS Lambda function. Stack creation now sits at CREATE_IN_PROGRESS on that resource for about an hour and then fails with a timeout. The function's CloudWatch logs show it completed in 20 seconds, and the SaaS API returned HTTP 200 and shows the environment registered.
What is the most likely cause?
Show answer and explanation
Answer:
Custom resources are request/response, and the response does not travel back through the Lambda return value. CloudFormation "sends a request to the specified service token" that includes "a pre-signed Amazon S3 bucket URL, where the custom resource sends responses to", and the provider "processes the CloudFormation request and returns a response of SUCCESS or FAILED to the pre-signed URL." CloudFormation then "waits and listens for a response in the pre-signed URL location", and "if a FAILED response or no response is returned, the operation fails." The default response timeout is 3600 seconds, which matches the roughly one-hour hang. Work succeeding in the function while the stack hangs is the signature of a missing response upload.
Option A is not a real constraint. An unqualified function ARN is a perfectly valid ServiceToken; CloudFormation invokes $LATEST and the invocation clearly happened, since the function logged and called the SaaS API.
Option C inverts how the timeouts work. ServiceTimeout bounds how long CloudFormation waits for a response; it does not drive re-invocation, and a function that completes in 20 seconds is nowhere near its own timeout anyway.
Option D would fail immediately. The SNS topic or Lambda function "must be in the same Region where the stack will be created", and a cross-Region service token fails to invoke rather than running to completion and logging success.
Reference: Create custom provisioning logic with custom resources