Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is using AWS CloudFormation to deploy a web application. The template requires a database password that must be retrieved securely without being hardcoded or exposed in plaintext. During the deployment testing phase, the developer also needs to ensure that if any resource fails to create or update, the stack does not automatically revert its changes, allowing the developer to investigate the failed resource state.

Which two actions should the developer take to meet these requirements? (Select TWO.)

  1. Reference the database password in the template using the dynamic reference pattern for AWS Secrets Manager.Answer
  2. Specify the --disable-rollback parameter when executing the create-stack or update-stack command via the AWS CLI.Answer
  3. C
    Reference the database password in the template using the dynamic reference pattern for a Systems Manager Parameter Store parameter of type String.
  4. D
    Manually delete the failed resource via the AWS Management Console and run drift detection to trigger CloudFormation to automatically recreate the resource.
  5. E
    Store the database password in Systems Manager Parameter Store using a standard String parameter type to optimize cost, and import it as a template parameter.

Answer

Reference the database password using the AWS Secrets Manager dynamic reference pattern, and specify the --disable-rollback parameter when executing the create-stack or update-stack command via the AWS CLI.
The correct options are referencing the database password using the dynamic reference pattern for AWS Secrets Manager and specifying the --disable-rollback parameter when executing the create-stack or update-stack command. AWS Secrets Manager dynamic references securely fetch credentials at deployment time without exposing them. The --disable-rollback parameter prevents the stack from automatically reverting on failure, preserving the resource state for troubleshooting.

Step-by-Step Solution

1
Secure the database password by storing it in AWS Secrets Manager.
The password is encrypted and managed centrally, avoiding hardcoding.
AWS Secrets Manager is designed for storing sensitive secrets and credentials.
2
Update the CloudFormation template to reference the secret using the dynamic reference syntax: resolve:secretsmanager:secret-id.
CloudFormation retrieves the password dynamically at runtime during stack operations.
This prevents sensitive data from being recorded in the template or stack history.
3
Execute the stack creation or update command with the --disable-rollback CLI option.
If a deployment failure occurs, the stack remains in a failed state rather than rolling back.
This allows the developer to inspect the state and logs of the failed resources directly.

Key Concept

AWS CloudFormation secure parameter resolution and deployment troubleshooting
Rate this question

Topics

AWS CloudFormation

More questions from this topic