Examkin

Question

Difficulty: MediumTroubleshooting CloudFormation and CI/CD Deployments

A developer is troubleshooting a multi-account deployment pipeline in AWS CodePipeline. During the execution, the AWS CodeBuild stage fails with an AccessDenied error when attempting to assume a deployment role in a target AWS account. Additionally, a separate AWS CloudFormation deploy stage fails with an error indicating that the target stack is in the ROLLBACK_COMPLETE state from a previous failed creation. Which two actions must the developer take to resolve these failures? (Select TWO.)

  1. Delete the CloudFormation stack in the ROLLBACK_COMPLETE state before running the deployment pipeline again.Answer
  2. Update the trust policy of the target deployment role to allow the AssumeRole action from the CodeBuild service role principal.Answer
  3. C
    Execute the continue-update-rollback command using the AWS CLI to transition the CloudFormation stack out of the ROLLBACK_COMPLETE state.
  4. D
    Update the pipeline's CloudFormation deployment stage configuration to disable rollback on resource creation failure.
  5. E
    Add the target deployment role's ARN to the trust policy of the CodeBuild service role in the source account.

Answer

Delete the CloudFormation stack in the ROLLBACK_COMPLETE state before running the deployment pipeline again, and update the trust policy of the target deployment role to allow the AssumeRole action from the CodeBuild service role principal.
To resolve the deployment issues, the developer must delete the stack in the ROLLBACK_COMPLETE state because CloudFormation does not support updating a stack that failed during its initial creation. Additionally, to resolve the cross-account AccessDenied error, the developer must update the trust policy of the target role to trust the CodeBuild service role as a principal, permitting the sts:AssumeRole action.

Step-by-Step Solution

1
Identify the cause of the CloudFormation stage failure.
The target stack is determined to be in the ROLLBACK_COMPLETE state, indicating a failed initial creation.
CloudFormation does not allow updating a stack that failed during its initial creation and rolled back to ROLLBACK_COMPLETE. The stack must be deleted before a new creation attempt can succeed.
2
Address the ROLLBACK_COMPLETE state.
The stack is deleted.
Deleting the stack removes the blocked state, allowing the pipeline to create the stack from scratch on the next execution.
3
Identify the cause of the CodeBuild assume-role failure.
The CodeBuild service role in the source account cannot assume the target deployment role due to missing trust permissions.
Cross-account role assumption requires the target role's trust policy to explicitly grant the assuming principal permission to assume it.
4
Update the trust policy of the target deployment role.
The trust policy is updated to include the CodeBuild service role ARN as a trusted principal with the sts:AssumeRole action.
This establishes the trust relationship, allowing STS to successfully issue temporary credentials to CodeBuild to perform the deployment.

Key Concept

Cross-account IAM delegation and CloudFormation initial creation rollback handling
Rate this question

Topics

Troubleshooting CloudFormation and CI/CD Deployments

More questions from this topic