Examkin

Question

Difficulty: HardAWS CloudFormation

A developer is managing a production web application deployed via an AWS CloudFormation stack. The stack includes an Amazon RDS database and an Amazon ECS service. The database credentials must be rotated automatically every 30 days. To troubleshoot an urgent connectivity issue, a system administrator manually modified the database security group rules and the database master password directly in the AWS Management Console. When the developer subsequently attempts to update the stack to deploy a new ECS task definition, the stack update fails.

Which two actions should the developer take to resolve the update failure and align the infrastructure with AWS security best practices? (Select TWO.)

  1. Run drift detection on the stack to identify the out-of-band changes, and update the CloudFormation template to match the current database security group configuration.Answer
  2. Store the database credentials in AWS Secrets Manager, and reference them in the CloudFormation template using dynamic references to support automatic rotation.Answer
  3. C
    Store the database credentials in Systems Manager Parameter Store as String parameters, and enable the native Parameter Store rotation schedule.
  4. D
    Revert the manual security group modifications using the AWS Management Console, and use the `cfn-init` helper script within the ECS container definition to dynamically retrieve the new credentials during container startup.
  5. E
    Manually change the stack status to `ROLLBACK_COMPLETE` in the CloudFormation console to bypass the failed update, then proceed with the task definition deployment.

Answer

Run drift detection on the stack to identify the out-of-band changes, update the CloudFormation template to match the current database security group configuration, store the database credentials in AWS Secrets Manager, and reference them in the template using dynamic references.
To resolve the CloudFormation update failure due to manual out-of-band modifications, the developer should run drift detection to identify the changes and update the template configuration to match the current physical state. To securely manage the database password and satisfy the rotation requirement, the developer should store the credentials in AWS Secrets Manager, which natively supports automatic rotation, and reference them in the CloudFormation template using dynamic references.

Step-by-Step Solution

1
Detect drift to identify out-of-band changes.
The differences between the expected template configuration and the actual physical resource configuration of the security groups are identified.
This determines exactly what has changed manually so the template can be synchronized without overwriting intended configuration changes.
2
Update the template to match the drifted state.
The template definition of the security groups is updated to match the manually modified rules.
Aligning the template with the drifted state ensures subsequent CloudFormation updates do not fail due to configuration mismatch or attempt to overwrite the database's network access settings.
3
Migrate credentials to AWS Secrets Manager and configure dynamic references.
The database credentials are secured in Secrets Manager with automatic rotation enabled, and the template references them dynamically.
Secrets Manager provides secure storage and automatic rotation of credentials, which are referenced at runtime without hardcoding in the CloudFormation template or application configuration.

Key Concept

Handling resource drift and managing secrets securely in AWS CloudFormation.
Rate this question

Topics

AWS CloudFormation

More questions from this topic