SOA-C03 Images, CloudFormation, and CDK Guide

April 1, 2026

Study SOA-C03 Images, CloudFormation, and CDK: key concepts, common traps, and exam decision cues.

On this page

This lesson covers the provisioning side of CloudOps: building images, declaring infrastructure, diagnosing stack failures, and rolling shared patterns across accounts and Regions without console drift. SOA-C03 wants operators to prefer repeatable pipelines over one-off manual fixes.

StackSet: CloudFormation feature for deploying stacks across multiple accounts and Regions in a controlled way.

Image pipeline: Repeatable process for building and updating AMIs or container images instead of hand-maintaining them manually.

What AWS is really testing here

AWS wants you to recognize:

image creation and maintenance as an ongoing operations concern
CloudFormation and CDK as repeatable provisioning lanes, not optional documentation
deployment failures as diagnosable event streams with concrete causes
multi-account rollout as an organization-level control problem, not a copy-paste task
third-party IaC tooling as valid, but still subject to the same operational discipline

Choose the right provisioning control

Need	Strongest first lane	Why
Standardized EC2 base image maintenance	AMI pipeline or EC2 Image Builder	The goal is repeatable image hygiene and patching.
Repeatable resource creation from templates	CloudFormation	Native declarative infrastructure control and stack lifecycle tracking.
Higher-level infrastructure code that still deploys through AWS IaC	AWS CDK	CDK synthesizes CloudFormation while letting teams work in code.
Same stack across many accounts and Regions	CloudFormation StackSets	This is the purpose-built multi-account rollout tool.
Sharing supported resources across accounts	AWS RAM	Share resources securely without duplicating everything.
Organization already standardizes on external IaC workflows	Terraform or similar tooling with version control	Valid operational path when governed correctly.

CDK is not a separate control plane

One common exam trap is pretending CDK and CloudFormation are unrelated choices. They are not:

CloudFormation is the native stack engine.
CDK is a higher-level way to define infrastructure that synthesizes to CloudFormation.
StackSets extend the CloudFormation model across accounts and Regions.

Deployment troubleshooting order

Symptom	Strongest first check	Why
Stack creation fails	CloudFormation events and resource status	The event stream usually identifies the first failing resource.
Deployment works in one account but not another	Permissions, quotas, or organization/account settings	Multi-account rollout often fails on local boundary differences.
Resource cannot be created in a subnet	Subnet sizing, routing, or availability-zone alignment	Provisioning failures are often network-shape problems, not template syntax alone.
Template looks correct but rollout still fails	IAM roles, service-linked roles, or dependency ordering	The template may be valid while permissions are not.

Provision once, roll out safely

    flowchart LR
	    A["Golden AMI or container image"] --> B["Versioned IaC definition"]
	    B --> C["CloudFormation or CDK stack"]
	    C --> D["StackSets for multi-account / multi-Region rollout"]
	    C --> E["AWS RAM where supported sharing is needed"]
	    B --> F["Change review and deployment troubleshooting"]

Strong exam answers usually prefer:

versioned images instead of hand-built hosts
stack-based deployment instead of console recreation
organization-aware rollout instead of account-by-account drift
event and permission troubleshooting instead of blind retries

Common traps

Trap	Better thinking
“CDK replaces CloudFormation entirely.”	CDK still compiles into CloudFormation templates and stack operations.
“If a rollout spans many accounts, just script console actions.”	SOA-C03 wants controlled multi-account deployment patterns like StackSets.
“A failed stack means the service is unstable.”	First inspect stack events, permissions, quotas, and dependency failures.
“AWS RAM shares anything across any account automatically.”	RAM only shares supported resource types and still needs correct governance.

Decision order that usually wins

Ask whether the problem is mainly defining infrastructure, deploying it at scale, sharing existing resources, or debugging a failed rollout.
If the requirement is repeatable infrastructure deployment, stay in the CloudFormation or CDK lane.
If the rollout spans many accounts or Regions, escalate to StackSets.
If the problem is sharing supported resources across accounts without redeploying them, think AWS RAM, not StackSets.
If the deployment fails, go to the first failing stack event and the resource or permission behind it.

Quiz

Loading quiz…

Revised on Sunday, May 10, 2026

3.2 Ops Automation & Deploy Troubleshooting