Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer manages a web application deployed via an AWS CloudFormation stack. The stack contains an Amazon ECS service and an Amazon RDS database instance. During troubleshooting, a team member manually modifies the RDS security group rules in the AWS Management Console to allow temporary access. During a subsequent stack update to deploy a new ECS task definition, the update fails and the stack is left in the UPDATE_ROLLBACK_FAILED state. Additionally, the developer needs to store the database credentials securely and enable automatic rotation. Which approach should the developer take to resolve the stack's state and manage the credentials?

  1. Use the Continue Update Rollback feature in CloudFormation to return the stack to a stable state. Use drift detection to identify the manual security group modifications and update the CloudFormation template to match. Store the credentials in AWS Secrets Manager and reference them using a dynamic reference in the template.Answer
  2. B
    Execute a new stack update immediately using the update-stack CLI command. Store the credentials in Systems Manager Parameter Store, as it natively supports automatic rotation, and let the update overwrite the manual security group changes.
  3. C
    Delete the stack entirely to clear the rollback state, then redeploy it. Continue to manually configure the security groups in the console after deployment. Store the database credentials as secure string parameters in Systems Manager Parameter Store with automatic rotation.
  4. D
    Perform a nested stack update to bypass the rollback block on the main stack. Keep the security group rules manually managed in the console. Store the database credentials in the template's Parameters section with NoEcho set to true.

Answer

Use the Continue Update Rollback feature in CloudFormation to return the stack to a stable state. Use drift detection to identify the manual security group modifications and update the CloudFormation template to match. Store the credentials in AWS Secrets Manager and reference them using a dynamic reference in the template.
The correct approach involves first resolving the UPDATE_ROLLBACK_FAILED state by invoking the Continue Update Rollback action, which allows the stack to return to a stable ROLLBACK_COMPLETE state. Afterwards, drift detection should be used to identify manual, out-of-band changes (such as the security group modifications) so that the template can be updated to align with the actual infrastructure. For database credentials requiring automatic rotation, AWS Secrets Manager is the appropriate service, and using a dynamic reference in the template ensures secure integration without hardcoding secrets.

Step-by-Step Solution

1
Resolve the rollback state of the CloudFormation stack.
The stack transitions from UPDATE_ROLLBACK_FAILED to UPDATE_ROLLBACK_COMPLETE.
You cannot perform new updates on a stack stuck in UPDATE_ROLLBACK_FAILED. Continue Update Rollback must be executed to return the stack to a stable state.
2
Perform drift detection and reconcile out-of-band changes.
Template is updated to align with the manually modified security groups or the resources are reverted to match the template.
Out-of-band changes create drift, causing subsequent stack operations to fail or overwrite configuration unintentionally.
3
Configure secure credential management with automatic rotation.
Credentials are created in AWS Secrets Manager and referenced dynamically in the template.
AWS Secrets Manager natively supports automatic rotation of database credentials, unlike Systems Manager Parameter Store which only stores static parameters without built-in rotation workflows.

Key Concept

Handling CloudFormation rollback failures, managing resource drift, and using AWS Secrets Manager dynamic references for credentials requiring automatic rotation.
Estimated Time:2m 0s
Rate this question

Topics

AWS CloudFormation

More questions from this topic