How to Prevent CloudFormation from Resetting SSM Parameter Store Values on Stack Update?

DVA-C02 By islever Editorial Last updated Aug 5, 2026

Short answer

A Modify the CloudFormation stack to set the deletion policy to Retain for the Parameter Store parameters.

Question

A company's developer has deployed an application in AWS by using AWS CloudFormation. The CloudFormation stack includes parameters in AWS Systems Manager Parameter Store that the application uses as configuration settings. The application can modify the parameter values. When the developer updated the stack to create additional resources with tags, the developer noted that the parameter values were reset and that the values ignored the latest changes made by the application. The developer needs to change the way the company deploys the CloudFormation stack. The developer also needs to avoid resetting the parameter values outside the stack. Which solution will meet these requirements with the LEAST development effort?

Modify the CloudFormation stack to set the deletion policy to Retain for the Parameter Store parameters. Correct Answer
Create an Amazon DynamoDB table as a resource in the CloudFormation stack to hold configuration data for the application. Migrate the parameters that the application is modifying from Parameter Store to the DynamoDB table.
Create an Amazon RDS DB instance as a resource in the CloudFormation stack. Create a table in the database for parameter configuration. Migrate the parameters that the application is modifying from Parameter Store to the configuration table.
Modify the CloudFormation stack policy to deny updates on Parameter Store parameters.

Key Takeaways

This question tests understanding of how CloudFormation handles resource replacement during updates and how DeletionPolicy: Retain prevents CloudFormation from deleting and recreating resources (and thus resetting their values) when properties change.

When an application modifies SSM Parameter Store values outside of CloudFormation, stack updates can reset those values to their template-defined defaults. Setting the DeletionPolicy to Retain on the AWS::SSM::Parameter resource preserves the current values during stack updates with minimal development effort.

Common mistake: Many candidates choose Option D (stack policy to deny updates) because it sounds like it would protect the parameters. However, a stack policy that denies updates on SSM parameters will cause the entire stack update to fail if CloudFormation attempts to replace the resource, breaking the deployment workflow.

Expert Analysis

Understanding the Problem

The scenario describes a common anti-pattern: an application modifies SSM Parameter Store values at runtime, but those parameters are also managed by a CloudFormation stack. When the stack is updated (even for unrelated changes like adding tags to other resources), CloudFormation may detect a drift or attempt to reconcile the parameter values back to what is defined in the template, effectively resetting the application's runtime changes.

Why Option A is Correct

Option A — setting DeletionPolicy: Retain on the AWS::SSM::Parameter resource — is the correct answer with the LEAST development effort.

When CloudFormation updates a stack and determines that a resource needs to be replaced (deleted and recreated), the DeletionPolicy attribute controls what happens to the existing resource. With DeletionPolicy: Retain, CloudFormation will remove the resource from the stack's management but leave the actual SSM parameter intact in AWS, preserving its current value (including any modifications made by the application).

Resources:
  MyAppParameter:
    Type: AWS::SSM::Parameter
    Properties:
      Name: MyAppConfig
      Type: String
      Value: InitialValue
    DeletionPolicy: Retain

As noted by community member KarBiswa, this approach preserves parameter values during stack updates instead of deleting and recreating them. Community member yingying920928 correctly points out that this is the most straightforward approach.

Why Option D is Incorrect (Common Trap)

Option D suggests modifying the stack policy to deny updates on Parameter Store parameters. While this sounds protective, it creates a critical problem:

A stack policy that denies updates on a resource will cause the entire stack update operation to fail if CloudFormation determines that the resource needs to be replaced.
As community member Anandesh referenced from AWS documentation, stack policies are designed to protect resources from unintended updates, but they do not gracefully handle the scenario where CloudFormation needs to replace a resource.
The question states the developer needs to "avoid resetting the parameter values outside the stack" — meaning the application should continue to work. A stack policy denial would break the stack update entirely, which is not a viable solution.

Community member teban0130 correctly identified that DeletionPolicy applies to deletion scenarios, but missed that CloudFormation stack updates that involve resource replacement also trigger deletion behavior, making Option A applicable.

Why Options B and C are Incorrect

Options B and C suggest migrating configuration data to DynamoDB or RDS. While these would technically solve the problem by moving configuration outside of CloudFormation-managed SSM parameters, they require:

Significant development effort to migrate the application to use DynamoDB/RDS instead of SSM Parameter Store
Changes to application code to read/write from the new data store
Additional infrastructure management

The question explicitly asks for the solution with the LEAST development effort, making these options incorrect despite being technically viable.

Key Takeaway

When resources are modified outside of CloudFormation and you need to preserve those modifications during stack updates, DeletionPolicy: Retain is the simplest and most effective approach. It allows CloudFormation to remove the resource from stack management while preserving the actual AWS resource and its current state.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

When a question asks for the 'LEAST development effort' solution, prioritize answers that use existing AWS features and attributes (like DeletionPolicy) over answers that require migrating to new services or rewriting application code. Always evaluate whether a 'protective' solution might actually break the deployment workflow.

Community Votes

62%

38%

62% of anonymous learners picked answer A. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 12 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors, not of islever. The comments shown first are the most substantive of the thread — ranked by depth, community endorsement and relevance; expand the list below to read the rest.

From public community threads 12

SerialiDr 👍 4 Answered A

A. Modify the CloudFormation stack to set the deletion policy to Retain for the Parameter Store parameters. This solution allows the developer to avoid resetting the parameter values stored in AWS Systems Manager Parameter Store when updating the CloudFormation stack. By setting the deletion policy to Retain for those parameters, CloudFormation will preserve their values during stack updates instead of deleting and recreating them. It changes the way the company deploys the CloudFormation stack by modifying the deletion policy for the relevant parameters. It avoids resetting the parameter values outside the stack, as the values modified by the application will be retained during stack updates.
yingying920928 👍 3 Answered A

Option A is the most straightforward approach to ensure that the parameters are not deleted or reset to their original values when the stack is deleted or updated. Option D Modifying the stack policy to deny updates on Parameter Store parameters could prevent necessary updates and is not recommended as it could lead to stack update failures.
KarBiswa 👍 3 Answered A

This solution allows the developer to avoid resetting the parameter values stored in AWS Systems Manager Parameter Store when updating the CloudFormation stack. By setting the deletion policy to Retain for those parameters, CloudFormation will preserve their values during stack updates instead of deleting and recreating them.
monishvster 👍 3 Answered A

Should be A. As the developer also needs to avoid resetting the parameter values outside the stack.
Anandesh 👍 2 Answered D

There is no evidence from the wording in question that resources have been deleted from outside. Also, resetting the values does not mean factory reset wherein, somebody deleted the resource from outside and recreated it with default values. There is no evidence of that either. So, as per https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html#stack-policy-reference I would choose D

Show 7 more comments

Saurabh04 👍 2 Answered B

Option B (Use Amazon DynamoDB for Configuration Data): Create a DynamoDB table as a resource in the CloudFormation stack. Migrate the parameters from Parameter Store to the DynamoDB table. Allows the application to modify parameter values without affecting the stack.
ahadh7621 👍 1

I don't understand why it would be A. Reading the question again, "The developer "updated the stack to create additional resources with tags...noted that the parameter values were reset". A deletion policy only protects resources when a stack is deleted or "This capability also applies to stack update operations that lead to resources being deleted from stacks." (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-attribute-deletionpolicy.html) The parameters aren't being deleted but simply overwritten. In this case, to prevent the parameter store values from being overwritten, we can use a stack policy to prevent updates to a stack resource. "You can prevent stack resources from being unintentionally updated or deleted during a stack update by using a stack policy." (https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html#stack-policy-intro-example)
teban0130 👍 1 Answered D

La opción de DeletionPolicy: Retain aplica solo para la eliminacion de los recursos, la pregunta habla de la actualización del valor de SSM Parameter, una politica que haga el deny de poder actualizar los valores, permitirá proteger el cloudformation
albert_kuo 👍 1 Answered A

Resources: MyAppParameter: Type: "AWS::SSM::Parameter" Properties: Name: "MyAppParameter" Type: "String" Value: "InitialValue" DeletionPolicy: Retain
CrescentShared 👍 4 Answered D

It is D
Abdullah22 👍 2 Answered D

I am going with D.
65703c1 👍 1 Answered A

A is the correct answer.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Practice All DVA-C02 Questions

Access 100 questions with complete answers and detailed explanations.

View Full DVA-C02 Practice Test →

← Back to DVA-C02 Study Guide