Examkin

Question

Difficulty: MediumAWS CloudFormation

A development team uses AWS CloudFormation to manage a serverless application consisting of Amazon DynamoDB tables and AWS Lambda functions. The application requires a database API key that must be rotated every 30 days. Additionally, a developer recently modified the read capacity units of one of the DynamoDB tables directly in the AWS Management Console to handle a temporary traffic spike. The team now needs to perform a stack update to deploy new application logic while addressing both the rotation requirement and the manual configuration changes.

Which of the following actions should the team take to meet these requirements? (Select TWO.)

  1. Store the database API key in AWS Secrets Manager, configure automatic rotation for the secret, and reference the secret in the CloudFormation template using a dynamic reference.Answer
  2. B
    Store the database API key in AWS Systems Manager Parameter Store as a SecureString parameter, and configure automatic rotation directly within the Parameter Store console.
  3. Perform drift detection on the CloudFormation stack, identify the modified DynamoDB read capacity properties, and update the CloudFormation template or the resource to resolve the drift before updating the stack.Answer
  4. D
    Execute the stack update using the AWS CLI with the --force-update-stack option to automatically overwrite any manual out-of-band resource modifications.
  5. E
    Store the database API key as a secure parameter in Systems Manager Parameter Store, and use the ssm-secure dynamic reference in the template to trigger automatic rotation every 30 days.

Answer

Store the database API key in AWS Secrets Manager with automatic rotation enabled, reference it via a dynamic reference in the template, and run drift detection to identify and reconcile the manual DynamoDB configurations before updating the stack.
Storing the API key in AWS Secrets Manager is correct because Secrets Manager natively supports automatic rotation of secrets and allows safe retrieval via dynamic references in CloudFormation templates. Performing drift detection on the stack is correct because it identifies manual out-of-band changes, allowing the developer to align the template or resource state before applying the stack update, preventing update failures.

Step-by-Step Solution

1
Evaluate the secret storage and rotation requirement.
Determine that AWS Secrets Manager must be used because it provides built-in automatic rotation capabilities, unlike Systems Manager Parameter Store, and can be resolved in templates via dynamic references.
Parameter Store does not natively support automated secrets rotation, making Secrets Manager the correct choice.
2
Address the configuration drift from the manual out-of-band modifications.
Detect drift using CloudFormation drift detection, identify the difference in DynamoDB read capacity units, and update either the CloudFormation template or the resource to resolve the drift.
Updating a stack with out-of-band modifications can result in deployment failures or unintended resource configurations unless the template is synchronized with the actual state.

Key Concept

Managing secrets with rotation and handling resource drift in AWS CloudFormation.
Rate this question

Topics

AWS CloudFormation

More questions from this topic