Examkin

Question

Difficulty: Very hardAWS CloudFormation

An operations team manages a production application infrastructure stack deployed via AWS CloudFormation. The stack consists of an Amazon ECS service, an Application Load Balancer (ALB), and an Amazon DynamoDB table. During a previous template update, a resource configuration error caused a failure, leaving the stack stuck in the `UPDATE_ROLLBACK_FAILED` state. Additionally, a drift detection scan indicates that another team member manually modified the ALB's security group out-of-band to allow traffic from a new partner IP range. The team must successfully deploy the new application updates while preserving the manual security group modifications. Which combination of actions should the team take to meet these requirements? (Select TWO.)

  1. Run the `continue-update-rollback` command on the stack to return it to the `UPDATE_ROLLBACK_COMPLETE` state.Answer
  2. Update the CloudFormation template definition for the security group to match the manually allowed IP ranges before initiating the next stack update.Answer
  3. C
    Execute the `update-stack` command directly with the `--rollback-configuration` parameter to override the failed state and apply the new template.
  4. D
    Run the `resolve-drift` command to automatically synchronize the template definition with the live security group configurations.
  5. E
    Delete the stack and deploy it again, as CloudFormation will automatically detect the drifted security group during recreation and import its manual settings.

Answer

To resolve this issue, the team must run the `continue-update-rollback` command on the stack to return it to the `UPDATE_ROLLBACK_COMPLETE` state, and update the CloudFormation template definition for the security group to match the manually allowed IP ranges before initiating the next stack update.
To successfully deploy new updates while preserving the manual security group configurations, the team must first stabilize the stack by running `continue-update-rollback`, which moves it from `UPDATE_ROLLBACK_FAILED` to `UPDATE_ROLLBACK_COMPLETE`. Secondly, they must update the template code to match the manually added IP range rules. This reconciles the drift and prevents CloudFormation from overwriting the manual changes during the subsequent update.

Step-by-Step Solution

1
Address the failed rollback state
The stack transitions to the `UPDATE_ROLLBACK_COMPLETE` state.
CloudFormation stacks in the `UPDATE_ROLLBACK_FAILED` state do not accept updates. Running `continue-update-rollback` retries or bypasses the failed rollback actions to bring the stack back to a stable state.
2
Reconcile the configuration drift
The template definition is aligned with the live configuration of the security group.
Since the security group has been manually modified out-of-band, the template code must be updated to match these live settings. Otherwise, the next stack update would overwrite these manual rules or fail due to drift.
3
Perform the stack update
The stack is updated with the new template changes without losing the security group rules.
Once the stack is in a stable state and the template has been updated to reflect the drift, the stack update can proceed safely.

Key Concept

CloudFormation Stack Recovery and Drift Reconciliation
Rate this question

Topics

AWS CloudFormation

More questions from this topic