Examkin

Question

Difficulty: EasyAWS CloudFormation

A developer is maintaining a testing environment deployed via an AWS CloudFormation stack. To resolve a connectivity issue, the developer manually modifies the inbound port rules of an Amazon EC2 security group directly through the Amazon VPC Console. The developer now wants to identify the discrepancies between the live resource configurations and the definition in the original CloudFormation template. Which CloudFormation feature or action should the developer use to identify these configuration discrepancies?

  1. A
    Edit the resource configurations directly using the AWS CLI to force synchronization with the template.
  2. B
    Store the security group configurations in Systems Manager Parameter Store to automatically track updates.
  3. Use CloudFormation drift detection on the stack to identify which resources have been modified outside of CloudFormation.Answer
  4. D
    Re-run the stack update and select the option to automatically roll back any out-of-band changes.

Answer

Use CloudFormation drift detection on the stack to identify which resources have been modified outside of CloudFormation.
Running drift detection allows CloudFormation to compare the current status of the stack resources with the expected status defined in the stack template. It flags any resources that have been modified outside of CloudFormation management, providing a clear list of discrepancies.

Step-by-Step Solution

1
Identify that the developer made manual, out-of-band changes to a resource managed by a CloudFormation stack.
The resource is now in a state of configuration drift relative to the CloudFormation template.
Before performing any updates, the developer needs a way to compare the live infrastructure configuration with the template definition.
2
Evaluate the native features of AWS CloudFormation that support checking template compliance against actual resource state.
CloudFormation Drift Detection is the specific feature designed to detect discrepancies between the expected state (template) and the actual state.
This avoids having to manually audit each resource or risk stack update failures due to out-of-band configuration mismatches.

Key Concept

AWS CloudFormation Drift Detection
Rate this question

Topics

AWS CloudFormation

More questions from this topic