Examkin

Question

Difficulty: HardAWS CloudFormation

A developer is attempting to update an AWS CloudFormation stack that manages a microservices application. During a previous update attempt, a custom resource failed to stabilize, triggering a rollback. During the rollback, the stack became stuck in the `UPDATE_ROLLBACK_FAILED` state because an IAM role resource defined in the template had been manually deleted from the AWS account. The developer has created a new IAM role and needs to update the stack to use this new role.

How should the developer resolve this issue and successfully apply the update to the stack?

  1. Initiate the ContinueUpdateRollback operation and specify the deleted IAM role resource to be skipped. After the stack status transitions to UPDATE_ROLLBACK_COMPLETE, update the stack using the new template that references the new IAM role.Answer
  2. B
    Submit a new stack update with the corrected template immediately using the --force-update flag in the AWS CLI to bypass the current rollback state.
  3. C
    Run drift detection to automatically identify the missing IAM role, select the option to synchronize the stack resources with the physical resources, and then execute a standard stack update.
  4. D
    Store the new IAM role's ARN in AWS Systems Manager Parameter Store, configure the template to dynamically reference this parameter, and initiate a stack synchronization.

Answer

Initiate the ContinueUpdateRollback operation and specify the deleted IAM role resource to be skipped. After the stack status transitions to UPDATE_ROLLBACK_COMPLETE, update the stack using the new template that references the new IAM role.
The correct option outlines the required operational procedure for recovering a stack from the UPDATE_ROLLBACK_FAILED state when a resource (the IAM role) has been deleted out-of-band. The developer must use the ContinueUpdateRollback operation and opt to skip the deleted resource. This allows CloudFormation to bypass the missing resource and complete the rollback sequence, shifting the stack status to UPDATE_ROLLBACK_COMPLETE. From there, a regular stack update can be initiated using the corrected template that points to the new IAM role.

Step-by-Step Solution

1
Acknowledge the current stack state.
The stack is stuck in the UPDATE_ROLLBACK_FAILED state, which blocks any direct update actions.
CloudFormation prevents updates on stacks that are not in a clean, stable state (such as UPDATE_ROLLBACK_COMPLETE or CREATE_COMPLETE).
2
Trigger the ContinueUpdateRollback process.
The rollback resumes, but normally it would fail again because the IAM role is missing.
Initiating ContinueUpdateRollback is the only way to move the stack out of the failed rollback state.
3
Skip the deleted IAM role resource during the ContinueUpdateRollback operation.
CloudFormation marks the rollback of the missing IAM role as complete without attempting to modify it, allowing the rest of the stack rollback to finish successfully.
Skipping resources that cannot be rolled back (due to manual deletion) prevents the rollback from failing again.
4
Verify stack state and perform the update.
The stack reaches the UPDATE_ROLLBACK_COMPLETE state, and the developer successfully deploys the new template pointing to the new IAM role.
Once the stack is stable, it can process standard update requests normally.

Key Concept

CloudFormation Rollback Troubleshooting and Recovery
Rate this question

Topics

AWS CloudFormation

More questions from this topic