Examkin

Question

Difficulty: EasyAWS CloudFormation

A developer is configuring an AWS CloudFormation template to deploy an application that requires a database password. The password must be stored securely and rotated automatically every 30 days. Additionally, the developer must ensure that if a stack update fails, the resources are reverted to their previous working state. Which CloudFormation configurations and features should the developer use to meet these requirements? (Select TWO.)

  1. Use a CloudFormation dynamic reference to retrieve the database password from AWS Secrets Manager.Answer
  2. Allow the default CloudFormation behavior to roll back the stack automatically to its last stable state if the update fails.Answer
  3. C
    Use a Systems Manager Parameter Store dynamic reference to retrieve the password, and configure Parameter Store to rotate the secret every 30 days.
  4. D
    Change the password manually using the Amazon RDS console, then execute a CloudFormation drift detection operation to update the stack's template parameters.
  5. E
    Disable the stack's rollback-on-failure setting and execute the AWS CLI command to manually reconcile and clean up the database state.

Answer

To securely reference a rotating password and ensure automatic rollback on failure, the developer should use a dynamic reference to retrieve the database password from AWS Secrets Manager and allow CloudFormation to execute its default automatic rollback behavior.
To retrieve a secret that rotates automatically, using a dynamic reference to AWS Secrets Manager is the correct choice because Secrets Manager natively handles automatic secret rotation. Allowing the default CloudFormation rollback behavior ensures that any failed updates are automatically reverted to the last stable configuration without manual intervention.

Step-by-Step Solution

1
Select a secure storage service for the database password that supports rotation.
Identify AWS Secrets Manager as the appropriate service because it supports automatic rotation, unlike Systems Manager Parameter Store.
The requirements demand a secure password storage solution that rotates every 30 days.
2
Integrate the secure storage with the CloudFormation template.
Configure a dynamic reference in the template to fetch the password from AWS Secrets Manager at deployment time.
Dynamic references retrieve sensitive values from external systems without exposing them in plaintext inside the template.
3
Evaluate the rollback strategy for failed updates.
Ensure default automatic rollback is enabled for the stack.
CloudFormation's default behavior is to roll back to the last stable state automatically when an update fails, satisfying the requirement to revert changes.

Key Concept

AWS CloudFormation manages resources declaratively. Using dynamic references to AWS Secrets Manager handles rotating credentials securely, while default stack rollback behavior ensures automated state recovery from update failures.
Estimated Time:1m 0s
Rate this question

Topics

AWS CloudFormation

More questions from this topic