Examkin

Question

Difficulty: MediumAWS CloudFormation

An application deployed via an AWS CloudFormation stack requires a database password that must be rotated automatically every 30 days. Additionally, operators occasionally make direct manual changes to the security group rules associated with the stack, which causes drift between the physical resources and the template definition. Which two actions should the developer take to manage these requirements?

  1. Store the password in AWS Secrets Manager, enable automatic rotation, and reference the password in the CloudFormation template using a dynamic reference.Answer
  2. Use AWS CloudFormation drift detection to identify manual modifications, and then update the template or resource properties to align with the actual state.Answer
  3. C
    Store the password in AWS Systems Manager Parameter Store as a SecureString parameter, and configure automatic rotation directly in the Parameter Store console.
  4. D
    Perform the stack update with the AWS CLI using the --ignore-drift parameter to allow CloudFormation to overwrite any manual resource modifications.
  5. E
    Run the AWS CLI command aws cloudformation rollback-stack when a stack update fails to automatically overwrite the out-of-band changes.

Answer

To securely manage the password and handle out-of-band configuration changes, the developer should store the password in AWS Secrets Manager with automatic rotation enabled and reference it in the CloudFormation template using dynamic references. In addition, the developer should use AWS CloudFormation drift detection to identify manual modifications and update the template or resource properties to align them.
The correct approach involves using AWS Secrets Manager to store the database password with automatic rotation and reference it securely in CloudFormation using dynamic references. Additionally, using CloudFormation drift detection helps developers identify out-of-band modifications to resources and synchronize the stack configuration, avoiding deployment failures.

Step-by-Step Solution

1
Determine the storage and rotation method for the password.
AWS Secrets Manager is selected because it supports automatic rotation natively, unlike Systems Manager Parameter Store.
Satisfies the security requirement for automatic 30-day rotation.
2
Reference the stored password in the CloudFormation template.
Use dynamic references to retrieve the password from Secrets Manager at deployment time.
Avoids hardcoding sensitive passwords in the CloudFormation template.
3
Resolve resource drift caused by manual changes.
Run drift detection on the stack to identify differences, and update the template or import the actual resources to align them.
Prevents future stack updates from failing due to conflicts with manual modifications.

Key Concept

AWS CloudFormation Drift Detection and AWS Secrets Manager Dynamic References
Rate this question

Topics

AWS CloudFormation

More questions from this topic