Examkin

Question

Difficulty: HardAWS CloudFormation

A developer is managing a web application infrastructure deployed via an AWS CloudFormation stack. The stack includes an Auto Scaling group of Amazon EC2 instances, which are configured using AWS::CloudFormation::Init metadata and helper scripts to install packages and start the application. During a stack update, the update fails and rolls back because the new instances do not signal success to the stack within the specified timeout. Additionally, the developer suspects that team members might have made manual configuration changes directly on the production EC2 instances. Which two actions should the developer take to troubleshoot the deployment failure and address the configuration drift? (Choose two.)

  1. Run drift detection on the CloudFormation stack to identify any out-of-band modifications made to the stack resources.Answer
  2. Inspect the /var/log/cfn-init.log and /var/log/cloud-init-output.log files on the EC2 instances to determine why the helper scripts failed to execute or signal success.Answer
  3. C
    Manually apply the configuration changes directly to the EC2 instances via the AWS Management Console to match the updated template before executing the stack update.
  4. D
    Store the database credentials in Systems Manager Parameter Store and configure built-in automatic rotation directly on the parameter.
  5. E
    Embed IAM user credentials directly within the EC2 instances' UserData script to ensure cfn-signal has permission to authenticate with CloudFormation.

Answer

Running drift detection on the CloudFormation stack and inspecting the /var/log/cfn-init.log and /var/log/cloud-init-output.log files on the EC2 instances.
To troubleshoot a rolling deployment failure where the EC2 instances fail to signal success, the developer must inspect the helper script logs. The /var/log/cfn-init.log file captures the output and status of the cfn-init metadata execution, while /var/log/cloud-init-output.log captures the standard output and error of the user data script execution. Additionally, running drift detection is the standard way to identify out-of-band resource modifications without manual inspection or disrupting the stack.

Step-by-Step Solution

1
Diagnose the rollback by connecting to the EC2 instances and reviewing logs.
Checking /var/log/cfn-init.log and /var/log/cloud-init-output.log reveals the specific step where the helper scripts failed or why cfn-signal was not invoked.
When a stack update rolls back due to a timeout, it means the stack did not receive a success signal from the instances within the WaitCondition timeout, and these log files contain the helper script execution history.
2
Audit the stack for drift by executing the drift detection tool on the CloudFormation stack.
A drift status report identifying which resources have been modified outside of CloudFormation, including the specific properties that differ from the template.
This determines if manual changes made by team members are causing configuration differences, which must be resolved to align the infrastructure with the template.

Key Concept

Troubleshooting CloudFormation helper scripts and managing stack drift.
Rate this question

Topics

AWS CloudFormation

More questions from this topic