Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is managing an infrastructure deployment consisting of two separate AWS CloudFormation stacks: a network stack that exports VPC resource identifiers, and an application stack that imports these identifiers using the `Fn::ImportValue` intrinsic function. The developer needs to update the network stack's outputs to support a new subnet configuration. Which of the following are valid constraints or required actions when modifying exported outputs that are referenced by other stacks? (Select TWO.)

  1. The network stack cannot be deleted, and its exported output values cannot be modified or deleted as long as they are referenced by the application stack.Answer
  2. To modify exported values in the network stack, the developer must first update the importing application stack to remove the references to those exports.Answer
  3. C
    The developer can run drift detection, manually modify the resource values directly in the AWS console, and then trigger a stack sync to update the cross-stack reference.
  4. D
    Sensitive credentials that require automatic rotation should be stored in Systems Manager Parameter Store and shared using cross-stack reference exports.
  5. E
    If the network stack update fails and is stuck in the `UPDATE_ROLLBACK_FAILED` state, the developer must update the referencing application stack to automatically force the network stack to rollback.

Answer

The network stack cannot be deleted, and its exported output values cannot be modified or deleted as long as they are referenced by the application stack; and to modify exported values in the network stack, the developer must first update the importing application stack to remove the references to those exports.
AWS CloudFormation enforces that you cannot delete a stack if its exported outputs are referenced by another stack, nor can you modify or delete any exported output value that is currently in use. To successfully change an exported value, the importing stack must first be updated to remove the reference to the export. Once the reference is removed, the exporting stack can be updated, and then the importing stack can be updated to reference the new export.

Step-by-Step Solution

1
Identify the dependency relationship between the two stacks, noting that the application stack imports values exported by the network stack.
Confirm that the network stack is the exporting stack and the application stack is the importing stack.
This establishes that the network stack outputs cannot be modified or deleted directly due to active external references.
2
Analyze how CloudFormation handles updates to exported values that are currently in use by other stacks.
Determine that CloudFormation will block any updates to the exporting stack that attempt to modify or delete the referenced outputs.
This is a core constraint of cross-stack references in AWS CloudFormation to prevent breaking dependent resources.
3
Formulate the correct remediation sequence to modify the subnet configuration output.
The developer must first update the application stack to remove the Fn::ImportValue references (e.g., by temporarily hardcoding the values or using another sharing mechanism), then update the network stack's outputs, and finally restore the references in the application stack.
This temporarily breaks the dependency lock, allowing the network stack update to proceed successfully.

Key Concept

AWS CloudFormation cross-stack references enforce strong dependencies, preventing the deletion of exporting stacks or modification of exported values until all referencing stacks remove their imports.
Estimated Time:2m 0s
Rate this question

Topics

AWS CloudFormation

More questions from this topic