Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is writing an AWS CloudFormation template to deploy a web application on an Amazon EC2 instance. The application requires a database password that needs automatic rotation, as well as several software packages. The developer wants to ensure that any updates to the software configuration in the template are automatically applied to the instance without replacing it.

Which two actions should the developer take to meet these requirements?

  1. Define the software configuration in the AWS::CloudFormation::Init resource metadata, run cfn-init in the UserData property to perform the initial installation, and configure the cfn-hup daemon to monitor changes.Answer
  2. Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.Answer
  3. C
    Store the database password in Systems Manager Parameter Store and retrieve it via a dynamic reference, utilizing its native scheduled parameter rotation features.
  4. D
    Install the packages by writing custom scripts in the EC2 UserData property, and instruct administrators to manually update the instance via SSH when template configurations change.
  5. E
    Execute the cfn-init script with the --rollback flag in UserData to monitor the stack status and roll back configuration files if a stack update enters the ROLLBACK_IN_PROGRESS state.

Answer

Use the AWS::CloudFormation::Init resource metadata along with the cfn-init script and cfn-hup daemon to install and update software configurations, and use AWS Secrets Manager with dynamic references to securely store and automatically rotate the database password.
The correct options involve configuring the software installation using the CloudFormation metadata framework (AWS::CloudFormation::Init, cfn-init, and cfn-hup) to detect and apply updates automatically, and using AWS Secrets Manager to retrieve rotated database passwords dynamically.

Step-by-Step Solution

1
Select the appropriate storage for secret parameters that require rotation.
Identify AWS Secrets Manager as the solution because it supports automatic rotation of credentials, unlike Systems Manager Parameter Store.
Ensures the database password is secure and complies with security requirements for rotation.
2
Select the mechanism for applying and updating EC2 packages without recreating the instance.
Combine AWS::CloudFormation::Init, the cfn-init helper script in UserData, and the cfn-hup daemon running on the instance.
This configuration allows the instance to pull metadata changes and apply updates dynamically.

Key Concept

AWS CloudFormation helper scripts and dynamic references for secret management.
Rate this question

Topics

AWS CloudFormation

More questions from this topic