Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer deployed an Amazon EC2 instance and an associated security group using an AWS CloudFormation stack. Later, a network administrator manually added an inbound rule allowing TCP port 3389 (RDP) directly via the Amazon VPC Console to troubleshoot a connection issue. The developer runs drift detection on the stack and confirms that the security group is in a drifted state. The developer wants to restore the security group to the exact configuration defined in the CloudFormation template. Which of the following is the correct method to resolve this drift?

  1. A
    Perform a stack update using the original CloudFormation template to force CloudFormation to overwrite the out-of-band changes and remove the RDP rule.
  2. B
    Initiate a stack rollback to the previous successful stack status to automatically revert the out-of-band security group changes.
  3. Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.Answer
  4. D
    Store the security group configuration in Systems Manager Parameter Store and enable automatic rotation to overwrite any out-of-band changes.

Answer

Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.
Manually removing the out-of-band RDP rule is the correct way to resolve the drift. When a resource is modified out-of-band, CloudFormation drift detection flags the difference but does not automatically remediate it. To resolve the drift without changing the template, the resource must be manually modified to align back with the template definition.

Step-by-Step Solution

1
Analyze the source of the configuration drift.
Identify that the security group has an extra inbound RDP rule added manually.
To determine how the live resource differs from the CloudFormation template definition.
2
Evaluate whether a standard stack update using the original template can remediate the drift.
Determine that running an update with the same template does not overwrite manual changes because CloudFormation checks template differences, not live resource differences.
To rule out stack updates as an automatic remediation tool for unmodified templates.
3
Manually remove the unauthorized inbound RDP rule.
The security group configuration matches the CloudFormation template, resolving the drift.
To successfully restore the stack's resources to their expected template-defined state.

Key Concept

AWS CloudFormation Drift Detection and Remediation
Rate this question

Topics

AWS CloudFormation

More questions from this topic