Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is deploying a three-tier web application using an AWS CloudFormation template. The template defines an Amazon RDS DB instance that requires database credentials. The company's security policy requires that database passwords must be stored securely, rotated every 30 days, and retrieved dynamically during stack operations. Additionally, the developer must ensure that any failed stack updates automatically revert to the last stable state without leaving orphaned resources or requiring manual intervention. Which two actions should the developer take to meet these security and deployment requirements? (Select TWO.)

  1. Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format.Answer
  2. Rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.Answer
  3. C
    Store the database password in Systems Manager Parameter Store as a standard String parameter and use the Ref intrinsic function to retrieve the password.
  4. D
    If a stack update fails and enters the UPDATE_ROLLBACK_FAILED state, immediately execute another update stack command with a corrected template to clear the status.
  5. E
    Manually delete the resources that failed to update using the AWS Management Console to force the stack to bypass the rollback phase.

Answer

Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format, and rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.
Storing database credentials in AWS Secrets Manager and referencing them using dynamic references satisfies the credential security and 30-day rotation policy while keeping passwords out of plaintext template properties. Relying on default CloudFormation update rollbacks ensures that stack updates that fail revert all affected resources back to their original stable configurations automatically.

Step-by-Step Solution

1
Select AWS Secrets Manager as the secure vault for credentials.
The database password is created and stored in AWS Secrets Manager, allowing automatic 30-day rotation configurations.
Parameter Store does not support automatic rotation natively, making Secrets Manager the compliant choice for rotated secrets.
2
Integrate the secret reference into the CloudFormation template using dynamic references.
CloudFormation retrieves the password dynamically at runtime during stack operations without exposing the password in template files.
Dynamic references are resolved only during resource provisioning and keep plaintext passwords out of templates and outputs.
3
Determine the automatic rollback strategy on deployment failure.
The rollback mechanism reverts stack resources back to their pre-update state, returning the stack to UPDATE_ROLLBACK_COMPLETE on failure.
This behavior prevents orphan resources and returns the infrastructure configuration to the last known stable state.

Key Concept

AWS CloudFormation deployment lifecycle controls stack update rollbacks and integrates with AWS Secrets Manager via dynamic references to handle rotated secrets securely.
Estimated Time:2m 0s
Rate this question

Topics

AWS CloudFormation

More questions from this topic