Examkin

Question

Difficulty: HardAWS CloudFormation

A developer is managing a production infrastructure stack deployed via AWS CloudFormation. The stack contains an Amazon RDS DB instance and an Amazon ECS service. To prevent accidental replacement or deletion of the production database, the developer applies a stack policy to the stack. The policy contains a Deny statement for all update actions on the RDS DB instance resource, while allowing updates on all other resources.

The developer now needs to update the database engine version of the RDS DB instance. The developer attempts to perform a stack update with a template containing the new engine version, but the update fails due to the stack policy.

Which of the following is the correct method to update the database engine version while preserving the protective stack policy for future updates?

  1. A
    Manually update the database engine version using the Amazon RDS console, and then perform a CloudFormation drift detection operation to automatically synchronize the change and update the CloudFormation stack template.
  2. B
    Execute the continue-update-rollback command and specify the RDS DB instance resource to be skipped, which bypasses the stack policy validation and forces the update to apply.
  3. Perform the stack update by using the AWS CLI update-stack command, passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter.Answer
  4. D
    Store the new engine version parameter in AWS Systems Manager Parameter Store as a SecureString, and reference it via a custom resource in the template to update the database engine version.

Answer

Perform the stack update by using the AWS CLI update-stack command, passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter.
The correct answer is to perform the stack update by using the AWS CLI update-stack command while passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter. When a stack policy is associated with a CloudFormation stack, all resources are protected by default unless explicitly allowed. To update a protected resource, the developer must temporarily override the stack policy during the update process. The --stack-policy-during-update-body parameter allows providing a temporary policy that permits the update. Once the update completes, CloudFormation automatically reverts to the original stack policy, maintaining the protection for subsequent updates.

Step-by-Step Solution

1
Define a temporary stack policy JSON document that explicitly allows updates (such as Update:Modify) to the target RDS DB instance resource.
A JSON stack policy document is created for temporary use during the update.
This policy is required to temporarily override the existing Deny rule on the database resource.
2
Run the aws cloudformation update-stack command with the --stack-policy-during-update-body flag, referencing the temporary stack policy.
CloudFormation executes the stack update and successfully applies the database engine version update.
Passing the temporary policy allows CloudFormation to bypass the permanent Deny rule for the duration of this single update transaction.
3
Verify that the update has completed and the stack status is UPDATE_COMPLETE.
The stack policy reverts to the original, permanent policy containing the Deny rule.
The temporary policy is only active during the update process, ensuring the database remains protected against accidental updates afterwards.

Key Concept

CloudFormation Stack Policies and temporary overrides during updates
Estimated Time:2m 30s
Rate this question

Topics

AWS CloudFormation

More questions from this topic