Examkin

Question

Difficulty: MediumAWS CloudFormation

A developer is deploying updates to an AWS CloudFormation stack. The update fails due to a configuration error, initiating an automatic rollback. However, the rollback fails because a security group managed by the stack was manually attached to an EC2 instance outside of CloudFormation, placing the stack in the UPDATE_ROLLBACK_FAILED state. The developer needs to successfully complete the rollback and return the stack to a stable state. Which action should the developer take to resolve this issue?

  1. A
    Run the drift detection tool on the stack, select the drifted security group, and choose the 'Import drifted resource state' option to force the template to sync with the manual changes.
  2. B
    Modify the CloudFormation template to delete the security group definition, and run a new stack update command with the '--force-update' flag to overwrite the active rollback status.
  3. Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.Answer
  4. D
    Create an Amazon EC2 launch template containing the security group, store the launch template ID in AWS Systems Manager Parameter Store as a parameter of type String, and reference it to force-complete the rollback.

Answer

Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.
When a resource deletion blocks a stack rollback, the correct procedure is to use the 'Continue update rollback' operation. This action allows the developer to skip the specific resource that is failing to roll back. CloudFormation will mark that resource's state as skipped and proceed to complete the rollback for the rest of the stack, bringing it back to a stable UPDATE_ROLLBACK_COMPLETE status. Afterward, the developer must manually clean up the skipped resource.

Step-by-Step Solution

1
Identify the cause of the rollback failure.
Determine that the security group cannot be deleted because it is still in use by an out-of-band EC2 instance.
You must identify which resource is blocking the rollback before deciding on the recovery path.
2
Use the CloudFormation console or AWS CLI to execute the 'Continue update rollback' action.
Specify the security group in the list of resources to skip during the rollback operation.
Skipping the blocked resource allows CloudFormation to successfully complete the rollback process for all other resources, transitioning the stack to the UPDATE_ROLLBACK_COMPLETE state.
3
Perform manual remediation of the skipped resource.
Manually detach the security group from the out-of-band EC2 instance and clean up the association.
Since the resource was skipped, it remains in its current state and must be manually aligned with the desired state once the stack is stable.

Key Concept

Resolving UPDATE_ROLLBACK_FAILED states by skipping blocked resources during the Continue Update Rollback operation.
Rate this question

Topics

AWS CloudFormation

More questions from this topic