# Exercise 1: Write and Safely Update a CloudFormation Template

```
STEP 1. Write a template with a parameter Env (dev|prod) creating:
        - an SQS queue + DLQ (redrive after 5 receives)
        - an S3 bucket with public access blocked, SSE-S3, versioning only in prod
          (Condition), DeletionPolicy Retain
        - an SNS topic with an email subscription only in prod
        - outputs (exported) for the queue URL and bucket ARN
STEP 2. Reference a DB password from Secrets Manager with a dynamic reference in a
        (hypothetical) AWS::RDS::DBInstance resource — no NoEcho parameter.
STEP 3. You now want to rename the bucket's BucketName property. Create a change set
        and describe what it shows and why that's dangerous. How do you rename safely?
STEP 4. Enable termination protection and a stack policy that denies Update:Replace
        and Update:Delete on the bucket.
STEP 5. Explain how drift detection would report a versioning change made in the console.
```

## Requirements Checklist

- [ ] Template validates (`aws cloudformation validate-template`) and uses `Conditions` (`!Equals`) with `!If` for versioning and `Condition:` on the subscription.
- [ ] Redrive policy uses `!GetAtt Dlq.Arn` with `maxReceiveCount: 5`.
- [ ] Bucket has `DeletionPolicy: Retain` and `UpdateReplacePolicy: Retain`.
- [ ] Outputs use `Export` with `!Sub "${AWS::StackName}-…"`.
- [ ] Dynamic reference `{{resolve:secretsmanager:…:SecretString:password}}` (or `ManageMasterUserPassword: true`).
- [ ] Changing `BucketName` requires **replacement** (change set shows `Replacement: True`) → new empty bucket; safe path: create the new bucket, copy data, switch references, then remove the old one (or keep the name).
- [ ] `update-termination-protection --enable-termination-protection` and a stack policy JSON denying `Update:Replace`/`Update:Delete` on the bucket's logical ID.
- [ ] Drift detection shows the bucket as `MODIFIED` with the property difference.