Examkin

Question

Difficulty: HardAWS CloudFormation

A developer is deploying a web application using AWS CloudFormation. The template configures an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The EC2 instances must install application software packages and retrieve a database password from parameter storage during startup. The database password must be rotated automatically every 30 days. Currently, the stack deployment finishes and is marked complete before the application initialization script finishes on the EC2 instances, causing the application to fail to connect to the database. How should the developer configure the CloudFormation template and startup scripts to resolve these issues in a secure and reliable manner?

  1. A
    Configure the launch template's UserData to run the initialization. If the configuration fails and the stack transitions to the ROLLBACK_IN_PROGRESS state, use the UpdateStack API with the ContinueUpdateRollback parameter to force the instances to retry the setup script without deleting the stack resources.
  2. B
    Configure a CreationPolicy on the Auto Scaling group resource. Store the database password in AWS Systems Manager Parameter Store as a Standard Parameter to reduce costs, and use the ssm dynamic reference in the launch template's UserData to inject the password. Execute cfn-signal at the start of the UserData script before the application installation begins.
  3. Configure a CreationPolicy on the Auto Scaling group resource. Store the database password in AWS Secrets Manager to support automatic rotation, and configure the EC2 instances to retrieve the password at runtime using the AWS SDK. In the launch template's UserData script, execute the software installation, retrieve the database password, and invoke the cfn-signal helper script only after the initialization is fully complete.Answer
  4. D
    Manually log in to each EC2 instance after CloudFormation completes the stack deployment to install the software packages and configure the database connection. Run CloudFormation drift detection on the Auto Scaling group to ensure that the manual changes do not cause the stack to drift from its template definition.

Answer

Configure a CreationPolicy on the Auto Scaling group resource. Store the database password in AWS Secrets Manager to support automatic rotation, and configure the EC2 instances to retrieve the password at runtime using the AWS SDK. In the launch template's UserData script, execute the software installation, retrieve the database password, and invoke the cfn-signal helper script only after the initialization is fully complete.
The correct solution uses a CreationPolicy on the Auto Scaling group resource to halt the stack creation progress until a success signal is received. By placing the cfn-signal command at the end of the UserData script, the developer ensures that the signal is only sent after the software packages are fully installed and configured. Furthermore, AWS Secrets Manager is used because it natively supports the required 30-day automatic rotation, and retrieving the secret at runtime using the AWS SDK is a secure practice.

Step-by-Step Solution

1
Configure a CreationPolicy on the Auto Scaling group resource in the CloudFormation template.
CloudFormation will pause the resource creation process and wait for a specified number of success signals before transitioning the Auto Scaling group to CREATE_COMPLETE.
This prevents CloudFormation from marking the stack creation as successful before the instances are actually ready.
2
Store the database password in AWS Secrets Manager and enable automatic rotation.
The password is secure, and Secrets Manager automatically rotates it every 30 days without manual intervention.
Systems Manager Parameter Store does not natively support automatic rotation of secrets, making Secrets Manager the correct choice for this requirement.
3
Modify the instance launch template's UserData to install the application, retrieve the password via AWS SDK, and invoke cfn-signal at the end of the script.
The instances configure themselves on startup and signal CloudFormation of success only after all initialization steps are complete.
Signaling only at the end of the script ensures the instance is fully operational before the stack transitions to success.

Key Concept

CloudFormation CreationPolicy, helper scripts (cfn-signal), and Secrets Manager integration
Estimated Time:2m 30s
Rate this question

Topics

AWS CloudFormation

More questions from this topic