Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is deploying a multi-tier application using an AWS CloudFormation template. The template defines an Amazon RDS DBInstance that contains critical production data. To ensure data safety and prevent downtime, the developer must meet two requirements:

1. Prevent the database instance from being deleted when the CloudFormation stack is deleted.
2. Prevent the database instance from being accidentally updated or replaced during stack updates, while still allowing other stack resources to be updated.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

  1. Set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template.Answer
  2. Define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.Answer
  3. C
    Set the UpdateReplacePolicy attribute of the DBInstance resource to Delete in the template.
  4. D
    Manually enable deletion protection on the RDS DBInstance using the AWS Console, then run drift detection to update the stack state.
  5. E
    Store the database configuration parameters in Systems Manager Parameter Store and set a CloudFormation stack policy to restrict access to the parameter path.

Answer

The developer should set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template, and define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.
To satisfy the requirements, the developer must configure both DeletionPolicy and a Stack Policy. Setting the DeletionPolicy to Retain ensures that the RDS DBInstance is kept when the stack is deleted. Applying a Stack Policy with an explicit Deny for Update actions on the DBInstance resource prevents it from being modified or replaced during stack updates, while still allowing other stack resources to be updated.

Step-by-Step Solution

1
Identify the mechanism to prevent resource deletion upon stack deletion.
Determine that setting the DeletionPolicy attribute to Retain in the template ensures the DBInstance persists even if the CloudFormation stack is deleted.
By default, deleting a stack deletes all of its resources. The DeletionPolicy attribute allows overriding this behavior for specific resources.
2
Identify the mechanism to prevent resource updates or replacement during stack updates.
Determine that applying a Stack Policy with an explicit Deny statement for Update actions on the DBInstance prevents accidental updates or replacements during stack updates.
Stack policies define update permissions for stack resources. Applying an explicit Deny on the DBInstance prevents modifications to it, while allowing other stack resources to update normally.

Key Concept

AWS CloudFormation Resource Lifecycle Protection
Estimated Time:1m 30s
Rate this question

Topics

AWS CloudFormation

More questions from this topic