Examkin

Question

Difficulty: HardAWS CloudFormation

A developer is managing a production database infrastructure stack using AWS CloudFormation. The template defines an Amazon RDS DB instance whose master password must be rotated automatically every 15 days. Additionally, a manual modification to the DB instance's security group settings made via the AWS Console has caused a subsequent CloudFormation stack update to fail, leaving the stack stuck in the UPDATE_ROLLBACK_FAILED state.

How should the developer securely reference the rotated password in the template and resolve the stack update failure?

  1. Store the password in AWS Secrets Manager and reference it using a dynamic reference in the template. To resolve the UPDATE_ROLLBACK_FAILED state, run the ContinueUpdateRollback action, manually correcting the out-of-band security group changes if necessary to match the expected state.Answer
  2. B
    Store the password in Systems Manager Parameter Store as a SecureString parameter and reference it using a dynamic reference. To resolve the UPDATE_ROLLBACK_FAILED state, force a stack update by running UpdateStack with a modified template that excludes the drifted security group resource.
  3. C
    Store the password in AWS Secrets Manager and reference it using a dynamic reference in the template. To resolve the UPDATE_ROLLBACK_FAILED state, execute drift detection and use the auto-revert feature to automatically sync the manual configuration changes back to the CloudFormation template.
  4. D
    Store the password in Systems Manager Parameter Store as a SecureString parameter. To resolve the UPDATE_ROLLBACK_FAILED state, delete the stack to clean up the failed resources and redeploy the template with the updated security group configurations.

Answer

Store the password in AWS Secrets Manager and reference it using a dynamic reference in the template. To resolve the UPDATE_ROLLBACK_FAILED state, run the ContinueUpdateRollback action, manually correcting the out-of-band security group changes if necessary to match the expected state.
AWS Secrets Manager is the correct service for credentials that require automatic rotation. By referencing the secret via a dynamic reference in the template, CloudFormation retrieves the rotated credential securely. If an update fails and the rollback gets blocked (UPDATE_ROLLBACK_FAILED state), standard update actions are unavailable. The developer must invoke ContinueUpdateRollback to resume the rollback, manually aligning the out-of-band changes with the expected state to allow the rollback to finish.

Step-by-Step Solution

1
Select the correct credential storage service based on requirements
AWS Secrets Manager is chosen for password storage.
The security requirement states that the password must be rotated every 15 days. AWS Secrets Manager offers native, built-in support for rotating credentials, whereas Systems Manager Parameter Store does not support automated rotation without writing custom Lambda rotation logic.
2
Define the CloudFormation referencing method
Reference the secret using a dynamic reference string in the template.
Using a dynamic reference format like '{{resolve:secretsmanager:secret-id:SecretString:password}}' allows CloudFormation to securely pull the latest rotated password version during deployments without exposing the value in plaintext.
3
Identify the stack troubleshooting procedure
Invoke the ContinueUpdateRollback operation.
When a stack update fails and the subsequent rollback also fails, the stack gets locked in UPDATE_ROLLBACK_FAILED. Regular updates are blocked in this state. The developer must call ContinueUpdateRollback, which allows the rollback to proceed (often requiring manual reconciliation of the drifted resource in the console or CLI to match the rollback target configuration first).

Key Concept

Managing Secrets Manager dynamic references with auto-rotation, and troubleshooting CloudFormation rollback failures caused by drift.
Rate this question

Topics

AWS CloudFormation

More questions from this topic