Examkin

AWS CloudFormation

57 questions

All types57Multiple choice29Multiple select28
Question 21Question →

A developer manages an AWS CloudFormation stack for a production application. The stack defines an Amazon S3 bucket with the `DeletionPolicy` attribute set to `Retain`. To update the application's storage architecture, the developer modifies the CloudFormation template to change the name of the S3 bucket, which requires resource replacement. Before executing the stack update, the developer manually deletes the original S3 bucket out-of-band using the AWS CLI. During the stack update, a name collision error occurs for the new S3 bucket, causing the update to fail and begin rolling back. The rollback fails because the original S3 bucket no longer exists, and the parent stack becomes stuck in the `UPDATE_ROLLBACK_FAILED` state.

Which sequence of actions must the developer take to resolve this failure and successfully complete the name change?

Show answer & explanation

Answer: Invoke the `ContinueUpdateRollback` action and select the original S3 bucket as a resource to skip. Once the stack returns to a stable state, update the template to use a globally unique name for the new S3 bucket, and then run the stack update again.

Answer

Invoke the `ContinueUpdateRollback` action and select the original S3 bucket as a resource to skip. Once the stack returns to a stable state, update the template to use a globally unique name for the new S3 bucket, and then run the stack update again.
The correct answer is to use the `ContinueUpdateRollback` action and skip the deleted S3 bucket. Because the original bucket was deleted manually, CloudFormation cannot recreate it or revert its state during the rollback, which blocks the stack. Skipping the resource during the rollback process lets the stack reach a stable status (`ROLLBACK_COMPLETE` or `UPDATE_ROLLBACK_COMPLETE`). From there, the template can be fixed with a unique bucket name to avoid collision and update successfully.

Step-by-Step Solution

1
Perform the ContinueUpdateRollback operation.
The stack skips rolling back the deleted S3 bucket and successfully transitions to the `ROLLBACK_COMPLETE` state.
When a stack update rollback fails due to a missing resource, skipping that resource allows CloudFormation to bypass the block and bring the stack to a stable state.
2
Modify the CloudFormation template to specify a globally unique name for the new S3 bucket.
The template is prepared with a unique resource name that will not cause a name collision.
The initial stack update failed due to a name collision, so a unique name is required for successful creation.
3
Initiate a new stack update using the updated template.
The stack updates successfully, creating the new S3 bucket and completing the replacement.
Since the stack is now in a stable state, it can accept new update commands to apply the corrected configuration.

Key Concept

CloudFormation update rollback recovery and handling resource replacement drift
Question 22Question →

A developer is managing a web application infrastructure using AWS CloudFormation. The developer needs to configure the stack to retrieve a database password securely and ensure that the deployed infrastructure remains consistent with the template definition. Which two actions should the developer take to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference.; Use CloudFormation stack updates to perform all infrastructure modifications, avoiding direct manual updates to the resources.

Answer

Storing the database password in AWS Secrets Manager and referencing it dynamically, and using CloudFormation stack updates to perform all infrastructure modifications.
The correct actions are storing the database password in AWS Secrets Manager using dynamic references to prevent exposing credentials, and performing all changes via CloudFormation stack updates to avoid resource drift.

Step-by-Step Solution

1
Identify the requirement for secure password retrieval.
AWS Secrets Manager is selected because it securely stores secrets and supports dynamic references in CloudFormation.
This avoids exposing credentials in plaintext.
2
Identify the requirement to prevent configuration drift.
Deploying all changes through CloudFormation stack updates instead of manual out-of-band modifications.
This maintains resource consistency and avoids drift-related failures during future updates.

Key Concept

AWS CloudFormation best practices for resource consistency and secrets management
Question 23Question →

A developer is managing a web application infrastructure deployed via an AWS CloudFormation stack. The stack includes an Auto Scaling group of Amazon EC2 instances, which are configured using AWS::CloudFormation::Init metadata and helper scripts to install packages and start the application. During a stack update, the update fails and rolls back because the new instances do not signal success to the stack within the specified timeout. Additionally, the developer suspects that team members might have made manual configuration changes directly on the production EC2 instances. Which two actions should the developer take to troubleshoot the deployment failure and address the configuration drift? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Run drift detection on the CloudFormation stack to identify any out-of-band modifications made to the stack resources.; Inspect the /var/log/cfn-init.log and /var/log/cloud-init-output.log files on the EC2 instances to determine why the helper scripts failed to execute or signal success.

Answer

Running drift detection on the CloudFormation stack and inspecting the /var/log/cfn-init.log and /var/log/cloud-init-output.log files on the EC2 instances.
To troubleshoot a rolling deployment failure where the EC2 instances fail to signal success, the developer must inspect the helper script logs. The /var/log/cfn-init.log file captures the output and status of the cfn-init metadata execution, while /var/log/cloud-init-output.log captures the standard output and error of the user data script execution. Additionally, running drift detection is the standard way to identify out-of-band resource modifications without manual inspection or disrupting the stack.

Step-by-Step Solution

1
Diagnose the rollback by connecting to the EC2 instances and reviewing logs.
Checking /var/log/cfn-init.log and /var/log/cloud-init-output.log reveals the specific step where the helper scripts failed or why cfn-signal was not invoked.
When a stack update rolls back due to a timeout, it means the stack did not receive a success signal from the instances within the WaitCondition timeout, and these log files contain the helper script execution history.
2
Audit the stack for drift by executing the drift detection tool on the CloudFormation stack.
A drift status report identifying which resources have been modified outside of CloudFormation, including the specific properties that differ from the template.
This determines if manual changes made by team members are causing configuration differences, which must be resolved to align the infrastructure with the template.

Key Concept

Troubleshooting CloudFormation helper scripts and managing stack drift.
Question 24Question →

A developer is maintaining a testing environment deployed via an AWS CloudFormation stack. To resolve a connectivity issue, the developer manually modifies the inbound port rules of an Amazon EC2 security group directly through the Amazon VPC Console. The developer now wants to identify the discrepancies between the live resource configurations and the definition in the original CloudFormation template. Which CloudFormation feature or action should the developer use to identify these configuration discrepancies?

Show answer & explanation

Answer: Use CloudFormation drift detection on the stack to identify which resources have been modified outside of CloudFormation.

Answer

Use CloudFormation drift detection on the stack to identify which resources have been modified outside of CloudFormation.
Running drift detection allows CloudFormation to compare the current status of the stack resources with the expected status defined in the stack template. It flags any resources that have been modified outside of CloudFormation management, providing a clear list of discrepancies.

Step-by-Step Solution

1
Identify that the developer made manual, out-of-band changes to a resource managed by a CloudFormation stack.
The resource is now in a state of configuration drift relative to the CloudFormation template.
Before performing any updates, the developer needs a way to compare the live infrastructure configuration with the template definition.
2
Evaluate the native features of AWS CloudFormation that support checking template compliance against actual resource state.
CloudFormation Drift Detection is the specific feature designed to detect discrepancies between the expected state (template) and the actual state.
This avoids having to manually audit each resource or risk stack update failures due to out-of-band configuration mismatches.

Key Concept

AWS CloudFormation Drift Detection
Question 25Question →

A developer is deploying a web application with a database backend using an AWS CloudFormation stack. The developer wants to ensure that the database credentials are managed securely and that the stack resources do not become inconsistent due to manual configurations. Which of the following actions should the developer take to achieve this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and retrieve them in the template using dynamic references.; Update the database and application configurations by modifying the CloudFormation template and performing a stack update rather than making manual changes.

Answer

Store the database credentials in AWS Secrets Manager and retrieve them using dynamic references, and update stack configurations by modifying the CloudFormation template and performing a stack update.
The correct options are to store database credentials in AWS Secrets Manager and reference them using dynamic references, and to perform configuration updates via CloudFormation template updates rather than manual console changes. This ensures credential security and maintains the stack integrity as the source of truth.

Step-by-Step Solution

1
Identify the secure storage mechanism for credentials.
AWS Secrets Manager is chosen to store database credentials securely.
Storing credentials in Secrets Manager with dynamic references prevents plaintext exposure in templates.
2
Determine the correct method for modifying stack resources.
Modify the CloudFormation template and perform a stack update instead of making manual changes.
This prevents configuration drift and ensures the template remains the single source of truth.

Key Concept

CloudFormation configuration drift management and secure parameter reference.
Question 26Question →

A developer is managing a web application infrastructure deployed via an AWS CloudFormation stack. The stack includes an Amazon RDS DB instance and an Amazon ECS service. The developer needs to update the database master password to a new value and configure the ECS tasks to retrieve this password securely. During the update attempt, the stack update fails because another team member manually modified the database security group rules directly in the Amazon VPC console to debug a connection issue. Which combination of actions should the developer take to resolve the update failure and secure the password? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Run drift detection on the CloudFormation stack, identify the differences in the database security group, and manually revert the security group rules in the VPC console to match the template definition before retrying the update.; Update the CloudFormation template to reference the database password using the {{resolve:secretsmanager:db-password}} dynamic reference, allowing ECS tasks to retrieve the password securely at runtime.

Answer

Run drift detection on the CloudFormation stack to identify changes and manually revert the security group rules in the VPC console. Additionally, update the template to use the AWS Secrets Manager dynamic reference for the database password.
To fix a stack update blocked by out-of-band modifications, the developer must first identify the drift and manually revert the changes in the console to match the template. To secure the database password, the developer should use the AWS Secrets Manager dynamic reference, which securely resolves the secret during resource creation and runtime without exposing it in plaintext.

Step-by-Step Solution

1
Initiate drift detection on the target CloudFormation stack.
The stack status reveals that the database security group has drifted from its template-defined state due to manual rules modifications.
Identifying the specific resources that have drifted is necessary to resolve conflicts before executing stack updates.
2
Manually revert the database security group rules in the VPC console back to the values specified in the CloudFormation template.
The security group configuration aligns perfectly with the template definition, and the drift status returns to IN_SYNC.
Resolving the drift state allows CloudFormation to execute updates without encountering resource state conflicts.
3
Modify the CloudFormation template to reference the database password from AWS Secrets Manager using the dynamic reference format.
The template uses the dynamic lookup expression to retrieve the credential securely at deployment and runtime.
This avoids hardcoding sensitive credentials in plaintext templates or parameters, meeting security compliance requirements.

Key Concept

Handling resource drift and managing secrets securely using dynamic references in AWS CloudFormation.
Estimated Time:2m 0s
Question 27Question →

A developer is managing a batch processing system deployed via an AWS CloudFormation stack. During an update of the stack, the deployment fails because of a resource configuration error, and CloudFormation automatically initiates a rollback. However, the rollback fails because an Amazon S3 bucket that was created by the stack has been manually deleted outside of CloudFormation. The stack is now stuck in the `UPDATE_ROLLBACK_FAILED` state. Which two actions must the developer take to resolve this issue and update the stack? (Choose two.)

Select all that apply

Show answer & explanation

Answer: Perform a `ContinueUpdateRollback` operation using the AWS CLI or CloudFormation console, specifying the logical ID of the deleted Amazon S3 bucket in the resources to skip parameter.; Wait for the stack to transition to the `UPDATE_ROLLBACK_COMPLETE` state, then perform a standard stack update using the corrected template.

Answer

Perform a `ContinueUpdateRollback` operation specifying the logical ID of the deleted S3 bucket to be skipped, and then perform a standard stack update using the corrected template after the stack transitions to the `UPDATE_ROLLBACK_COMPLETE` state.
To recover a stack in the UPDATE_ROLLBACK_FAILED state, you must use ContinueUpdateRollback and skip the resources that are causing the rollback to fail (such as the manually deleted S3 bucket). This allows the rollback operation to complete and the stack to transition to the UPDATE_ROLLBACK_COMPLETE state, which is a stable state. Once the stack is stable, you can perform a normal update with the corrected template to align it with the desired configuration.

Step-by-Step Solution

1
Initiate ContinueUpdateRollback
The stack skips the deleted S3 bucket resource during rollback.
This bypasses the rollback failure caused by the missing bucket.
2
Wait for UPDATE_ROLLBACK_COMPLETE state
The stack status transitions to UPDATE_ROLLBACK_COMPLETE.
The stack must be in a stable state before it can accept new update commands.
3
Run stack update with corrected template
The stack is updated with the corrected configuration.
This updates the resources and template definition to the desired state.

Key Concept

Handling AWS CloudFormation rollback failures and recovering from UPDATE_ROLLBACK_FAILED state by skipping deleted resources.
Question 28Question →

A developer is attempting to update an AWS CloudFormation stack that manages a microservices application. During a previous update attempt, a custom resource failed to stabilize, triggering a rollback. During the rollback, the stack became stuck in the `UPDATE_ROLLBACK_FAILED` state because an IAM role resource defined in the template had been manually deleted from the AWS account. The developer has created a new IAM role and needs to update the stack to use this new role.

How should the developer resolve this issue and successfully apply the update to the stack?

Show answer & explanation

Answer: Initiate the ContinueUpdateRollback operation and specify the deleted IAM role resource to be skipped. After the stack status transitions to UPDATE_ROLLBACK_COMPLETE, update the stack using the new template that references the new IAM role.

Answer

Initiate the ContinueUpdateRollback operation and specify the deleted IAM role resource to be skipped. After the stack status transitions to UPDATE_ROLLBACK_COMPLETE, update the stack using the new template that references the new IAM role.
The correct option outlines the required operational procedure for recovering a stack from the UPDATE_ROLLBACK_FAILED state when a resource (the IAM role) has been deleted out-of-band. The developer must use the ContinueUpdateRollback operation and opt to skip the deleted resource. This allows CloudFormation to bypass the missing resource and complete the rollback sequence, shifting the stack status to UPDATE_ROLLBACK_COMPLETE. From there, a regular stack update can be initiated using the corrected template that points to the new IAM role.

Step-by-Step Solution

1
Acknowledge the current stack state.
The stack is stuck in the UPDATE_ROLLBACK_FAILED state, which blocks any direct update actions.
CloudFormation prevents updates on stacks that are not in a clean, stable state (such as UPDATE_ROLLBACK_COMPLETE or CREATE_COMPLETE).
2
Trigger the ContinueUpdateRollback process.
The rollback resumes, but normally it would fail again because the IAM role is missing.
Initiating ContinueUpdateRollback is the only way to move the stack out of the failed rollback state.
3
Skip the deleted IAM role resource during the ContinueUpdateRollback operation.
CloudFormation marks the rollback of the missing IAM role as complete without attempting to modify it, allowing the rest of the stack rollback to finish successfully.
Skipping resources that cannot be rolled back (due to manual deletion) prevents the rollback from failing again.
4
Verify stack state and perform the update.
The stack reaches the UPDATE_ROLLBACK_COMPLETE state, and the developer successfully deploys the new template pointing to the new IAM role.
Once the stack is stable, it can process standard update requests normally.

Key Concept

CloudFormation Rollback Troubleshooting and Recovery
Question 29Question →

A developer is designing an AWS CloudFormation template to deploy an application that connects to an Amazon RDS database. The developer needs to store the database credentials securely and prevent the database from being accidentally deleted if the CloudFormation stack is deleted or updated. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and retrieve them in the template using dynamic references.; Configure the DeletionPolicy attribute with a value of Retain on the database resource in the template.

Answer

To securely manage the credentials and protect the database, the developer should store the database credentials in AWS Secrets Manager and retrieve them using dynamic references, and also configure the DeletionPolicy attribute with a value of Retain on the RDS database resource in the template.
Storing credentials in AWS Secrets Manager and referencing them using dynamic references keeps sensitive values encrypted and out of the template code. Setting the DeletionPolicy to Retain on the RDS resource prevents CloudFormation from deleting the database when the stack is deleted or the resource is updated out of the stack.

Step-by-Step Solution

1
Select a secure storage mechanism for the database credentials.
Determine that AWS Secrets Manager is the correct service for storing database credentials, and referencing it via CloudFormation dynamic references keeps them secure.
Hardcoding secrets or using unencrypted parameter types exposes sensitive information, violating security best practices.
2
Select a policy to prevent accidental resource deletion.
Determine that the DeletionPolicy attribute should be set to Retain on the RDS resource definition.
The Retain policy ensures that CloudFormation keeps the physical resource even if its stack is deleted or if the resource is removed during a stack update.
3
Eliminate incorrect options based on common AWS misconfigurations.
Discard options suggesting plaintext Parameter Store parameters, out-of-band console changes (which cause drift), or updating a stack that is currently in a rollback state.
These choices introduce security vulnerabilities, drift issues, or violate CloudFormation state machine rules.

Key Concept

AWS CloudFormation Resource Lifecycle and Credential Management
Question 30Question →

A developer is preparing to update an AWS CloudFormation stack that manages a production backend application. The update involves introducing a new external service API key that must be stored securely with support for automatic rotation. Additionally, the developer must ensure that any manual, out-of-band changes previously made to the stack's resources are identified and resolved before the update is performed to prevent deployment failures.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager, and reference it in the CloudFormation template using a dynamic reference.; Run drift detection on the CloudFormation stack, identify any drifted resources, and update the template or import resources to resolve the differences before updating the stack.

Answer

Storing the API key in AWS Secrets Manager and referencing it via a dynamic reference, and running drift detection to identify and resolve drifted resources before updating the stack.
Storing the API key in AWS Secrets Manager satisfies the requirements for secure storage and automatic rotation, and referencing it via a dynamic reference ensures security. Running drift detection identifies any out-of-band changes that would cause the stack update to fail, allowing the developer to synchronize the template and actual resource configurations before deploying the update.

Step-by-Step Solution

1
Select the appropriate storage service for the API key.
AWS Secrets Manager is chosen because it supports automatic rotation and secure credential storage.
Systems Manager Parameter Store does not offer native automatic rotation for secrets, whereas Secrets Manager does.
2
Integrate the secret securely in the CloudFormation template.
Reference the secret using the Secrets Manager dynamic reference format in the template.
This prevents hardcoding sensitive credentials in the template and allows retrieval at deployment time.
3
Identify out-of-band resource modifications.
Execute drift detection on the CloudFormation stack.
Drift detection reveals which resources have been modified outside of CloudFormation control.
4
Resolve resource drift before deploying the update.
Update the template to match the drifted state or import/re-import resources as necessary.
This ensures the stack state is synchronized with the template, preventing deployment conflicts and rollback failures.

Key Concept

CloudFormation update mechanics, drift detection, and secure parameter retrieval.
Question 31Question →

A developer is deploying a web application using AWS CloudFormation. The template configures an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The EC2 instances must install application software packages and retrieve a database password from parameter storage during startup. The database password must be rotated automatically every 30 days. Currently, the stack deployment finishes and is marked complete before the application initialization script finishes on the EC2 instances, causing the application to fail to connect to the database. How should the developer configure the CloudFormation template and startup scripts to resolve these issues in a secure and reliable manner?

Show answer & explanation

Answer: Configure a CreationPolicy on the Auto Scaling group resource. Store the database password in AWS Secrets Manager to support automatic rotation, and configure the EC2 instances to retrieve the password at runtime using the AWS SDK. In the launch template's UserData script, execute the software installation, retrieve the database password, and invoke the cfn-signal helper script only after the initialization is fully complete.

Answer

Configure a CreationPolicy on the Auto Scaling group resource. Store the database password in AWS Secrets Manager to support automatic rotation, and configure the EC2 instances to retrieve the password at runtime using the AWS SDK. In the launch template's UserData script, execute the software installation, retrieve the database password, and invoke the cfn-signal helper script only after the initialization is fully complete.
The correct solution uses a CreationPolicy on the Auto Scaling group resource to halt the stack creation progress until a success signal is received. By placing the cfn-signal command at the end of the UserData script, the developer ensures that the signal is only sent after the software packages are fully installed and configured. Furthermore, AWS Secrets Manager is used because it natively supports the required 30-day automatic rotation, and retrieving the secret at runtime using the AWS SDK is a secure practice.

Step-by-Step Solution

1
Configure a CreationPolicy on the Auto Scaling group resource in the CloudFormation template.
CloudFormation will pause the resource creation process and wait for a specified number of success signals before transitioning the Auto Scaling group to CREATE_COMPLETE.
This prevents CloudFormation from marking the stack creation as successful before the instances are actually ready.
2
Store the database password in AWS Secrets Manager and enable automatic rotation.
The password is secure, and Secrets Manager automatically rotates it every 30 days without manual intervention.
Systems Manager Parameter Store does not natively support automatic rotation of secrets, making Secrets Manager the correct choice for this requirement.
3
Modify the instance launch template's UserData to install the application, retrieve the password via AWS SDK, and invoke cfn-signal at the end of the script.
The instances configure themselves on startup and signal CloudFormation of success only after all initialization steps are complete.
Signaling only at the end of the script ensures the instance is fully operational before the stack transitions to success.

Key Concept

CloudFormation CreationPolicy, helper scripts (cfn-signal), and Secrets Manager integration
Estimated Time:2m 30s
Question 32Question →

A developer is managing a production web application deployed via an AWS CloudFormation stack. The stack includes an Amazon RDS database and an Amazon ECS service. The database credentials must be rotated automatically every 30 days. To troubleshoot an urgent connectivity issue, a system administrator manually modified the database security group rules and the database master password directly in the AWS Management Console. When the developer subsequently attempts to update the stack to deploy a new ECS task definition, the stack update fails.

Which two actions should the developer take to resolve the update failure and align the infrastructure with AWS security best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Run drift detection on the stack to identify the out-of-band changes, and update the CloudFormation template to match the current database security group configuration.; Store the database credentials in AWS Secrets Manager, and reference them in the CloudFormation template using dynamic references to support automatic rotation.

Answer

Run drift detection on the stack to identify the out-of-band changes, update the CloudFormation template to match the current database security group configuration, store the database credentials in AWS Secrets Manager, and reference them in the template using dynamic references.
To resolve the CloudFormation update failure due to manual out-of-band modifications, the developer should run drift detection to identify the changes and update the template configuration to match the current physical state. To securely manage the database password and satisfy the rotation requirement, the developer should store the credentials in AWS Secrets Manager, which natively supports automatic rotation, and reference them in the CloudFormation template using dynamic references.

Step-by-Step Solution

1
Detect drift to identify out-of-band changes.
The differences between the expected template configuration and the actual physical resource configuration of the security groups are identified.
This determines exactly what has changed manually so the template can be synchronized without overwriting intended configuration changes.
2
Update the template to match the drifted state.
The template definition of the security groups is updated to match the manually modified rules.
Aligning the template with the drifted state ensures subsequent CloudFormation updates do not fail due to configuration mismatch or attempt to overwrite the database's network access settings.
3
Migrate credentials to AWS Secrets Manager and configure dynamic references.
The database credentials are secured in Secrets Manager with automatic rotation enabled, and the template references them dynamically.
Secrets Manager provides secure storage and automatic rotation of credentials, which are referenced at runtime without hardcoding in the CloudFormation template or application configuration.

Key Concept

Handling resource drift and managing secrets securely in AWS CloudFormation.
Question 33Question →

A developer is writing an AWS CloudFormation template to deploy a web application. The application requires two configurations:
1. A database connection password that must be rotated automatically every 30 days.
2. A database connection port number, which is a non-sensitive configuration parameter.

To optimize operational efficiency, security, and cost, how should the developer store and reference these configurations in the CloudFormation template?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference in the template. Store the port number in Systems Manager Parameter Store and reference it using an SSM dynamic reference.

Answer

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference in the template. Store the port number in Systems Manager Parameter Store and reference it using an SSM dynamic reference.
The correct approach is to store the sensitive database password in AWS Secrets Manager because it supports native automatic rotation every 30 days. To optimize costs, the non-sensitive port number should be stored in Systems Manager Parameter Store as it is free for standard parameters. Both can be securely referenced in the CloudFormation template using dynamic references without exposing plaintext values.

Step-by-Step Solution

1
Analyze the security and rotation requirements for the database password.
Identify that AWS Secrets Manager is required because it natively supports automatic rotation (every 30 days) and secure storage of sensitive credentials.
To meet the security and compliance requirement of automated rotation.
2
Analyze the requirements for the database port number.
Identify that the port number is non-sensitive and does not require rotation or high-cost storage, making AWS Systems Manager Parameter Store the most cost-effective service.
To optimize costs and distinguish between sensitive and non-sensitive configurations.
3
Determine how to reference both configurations in the CloudFormation template securely.
Use CloudFormation dynamic references to retrieve the values at runtime without hardcoding them in the template.
To maintain infrastructure-as-code best practices and avoid credential exposure in version control.

Key Concept

AWS CloudFormation Dynamic References
Question 34Question →

A developer is managing an AWS CloudFormation stack for a production backend application. During a stack update, the deployment fails, and the stack enters the UPDATE_ROLLBACK_FAILED state because an IAM role referenced by the template was manually deleted out-of-band. The developer has corrected the template and needs to apply the update to the stack. Which action should the developer take to resolve the stack state and successfully deploy the update?

Show answer & explanation

Answer: Use the ContinueUpdateRollback operation to return the stack to the UPDATE_ROLLBACK_COMPLETE state, optionally recreating the deleted IAM role or skipping it during the rollback, and then perform the stack update with the corrected template.

Answer

Use the ContinueUpdateRollback operation to return the stack to the UPDATE_ROLLBACK_COMPLETE state (optionally skipping or recreating the deleted role), and then perform the stack update with the corrected template.
To update a CloudFormation stack that is stuck in the UPDATE_ROLLBACK_FAILED state, you must first return the stack to a stable state. Triggering ContinueUpdateRollback allows CloudFormation to complete the rollback by either skipping the deleted resource or using a recreated version of it. Once the stack is in the UPDATE_ROLLBACK_COMPLETE state, you can successfully apply the corrected template.

Step-by-Step Solution

1
Analyze the cause of the stack failure.
Confirm the stack is stuck in UPDATE_ROLLBACK_FAILED due to the missing IAM role.
You must identify the missing resource that is blocking CloudFormation from performing rollback operations.
2
Run the ContinueUpdateRollback operation.
Specify the deleted IAM role to be skipped during rollback, or recreate the IAM role with the exact same physical ID/name.
This allows CloudFormation to bypass the block and complete the rollback sequence.
3
Perform the stack update.
Deploy the corrected CloudFormation template once the stack reaches the stable UPDATE_ROLLBACK_COMPLETE state.
CloudFormation stack updates can only be initiated when the stack is in a stable, non-transitioning state.

Key Concept

Resolving CloudFormation update rollback failures due to deleted resources.
Estimated Time:1m 30s
Question 35Question →

A developer is designing an AWS CloudFormation template to deploy a microservice. The microservice requires access to a database password that must be automatically rotated every 30 days, as well as a non-sensitive API endpoint URL for an external service. Which two configuration strategies should the developer use to reference these values in the CloudFormation template to ensure security, rotation support, and cost-efficiency? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Reference the database password dynamically in the template using an AWS Secrets Manager dynamic reference.; Reference the non-sensitive API endpoint URL dynamically in the template using an AWS Systems Manager Parameter Store dynamic reference.

Answer

Referencing the database password dynamically in the template using an AWS Secrets Manager dynamic reference, and referencing the non-sensitive API endpoint URL dynamically in the template using an AWS Systems Manager Parameter Store dynamic reference.
For sensitive credentials requiring automatic rotation, the correct practice is to store them in AWS Secrets Manager and reference them via an AWS Secrets Manager dynamic reference. For non-sensitive configurations that do not need rotation, the correct and cost-efficient practice is to store them in AWS Systems Manager Parameter Store and reference them via a Parameter Store dynamic reference.

Step-by-Step Solution

1
Identify the security and rotation requirements for the sensitive database password.
Determine that AWS Secrets Manager is required because it supports native automatic rotation and encryption.
Secrets Manager is built to securely store sensitive data and automate rotation workflows.
2
Identify the requirements for the non-sensitive API endpoint URL.
Determine that AWS Systems Manager Parameter Store is the most appropriate service.
Parameter Store is more cost-effective for non-sensitive data and configuration parameters that do not require rotation.
3
Integrate both services into the CloudFormation template using dynamic references.
The template securely fetches the values at runtime without exposing them in plaintext or risking resource drift.
Dynamic references allow CloudFormation to retrieve external configuration values securely when the stack is created or updated.

Key Concept

Securely referencing sensitive credentials and non-sensitive configurations in AWS CloudFormation templates using Secrets Manager and Systems Manager Parameter Store.
Question 36Question →

A developer manages a web application deployed via an AWS CloudFormation stack. The stack contains an Amazon ECS service and an Amazon RDS database instance. During troubleshooting, a team member manually modifies the RDS security group rules in the AWS Management Console to allow temporary access. During a subsequent stack update to deploy a new ECS task definition, the update fails and the stack is left in the UPDATE_ROLLBACK_FAILED state. Additionally, the developer needs to store the database credentials securely and enable automatic rotation. Which approach should the developer take to resolve the stack's state and manage the credentials?

Show answer & explanation

Answer: Use the Continue Update Rollback feature in CloudFormation to return the stack to a stable state. Use drift detection to identify the manual security group modifications and update the CloudFormation template to match. Store the credentials in AWS Secrets Manager and reference them using a dynamic reference in the template.

Answer

Use the Continue Update Rollback feature in CloudFormation to return the stack to a stable state. Use drift detection to identify the manual security group modifications and update the CloudFormation template to match. Store the credentials in AWS Secrets Manager and reference them using a dynamic reference in the template.
The correct approach involves first resolving the UPDATE_ROLLBACK_FAILED state by invoking the Continue Update Rollback action, which allows the stack to return to a stable ROLLBACK_COMPLETE state. Afterwards, drift detection should be used to identify manual, out-of-band changes (such as the security group modifications) so that the template can be updated to align with the actual infrastructure. For database credentials requiring automatic rotation, AWS Secrets Manager is the appropriate service, and using a dynamic reference in the template ensures secure integration without hardcoding secrets.

Step-by-Step Solution

1
Resolve the rollback state of the CloudFormation stack.
The stack transitions from UPDATE_ROLLBACK_FAILED to UPDATE_ROLLBACK_COMPLETE.
You cannot perform new updates on a stack stuck in UPDATE_ROLLBACK_FAILED. Continue Update Rollback must be executed to return the stack to a stable state.
2
Perform drift detection and reconcile out-of-band changes.
Template is updated to align with the manually modified security groups or the resources are reverted to match the template.
Out-of-band changes create drift, causing subsequent stack operations to fail or overwrite configuration unintentionally.
3
Configure secure credential management with automatic rotation.
Credentials are created in AWS Secrets Manager and referenced dynamically in the template.
AWS Secrets Manager natively supports automatic rotation of database credentials, unlike Systems Manager Parameter Store which only stores static parameters without built-in rotation workflows.

Key Concept

Handling CloudFormation rollback failures, managing resource drift, and using AWS Secrets Manager dynamic references for credentials requiring automatic rotation.
Estimated Time:2m 0s
Question 37Question →

A developer is writing an AWS CloudFormation template to deploy an Amazon EC2 instance that runs a web application. The developer uses the AWS::CloudFormation::Init metadata key to install several software packages and configure application files during startup. However, when deploying the stack, CloudFormation marks the EC2 instance status as CREATE_COMPLETE immediately after the instance is provisioned, but before the software installation and configuration tasks have finished running. Which configuration should the developer implement to ensure the stack creation waits until the software setup on the instance is fully complete?

Show answer & explanation

Answer: Add a CreationPolicy attribute to the EC2 instance resource in the template, and execute the cfn-signal helper script at the end of the UserData property after the cfn-init execution.

Answer

Add a CreationPolicy attribute to the EC2 instance resource in the template, and execute the cfn-signal helper script at the end of the UserData property after the cfn-init execution.
The correct configuration is to add a CreationPolicy attribute to the EC2 instance resource and call the cfn-signal script at the end of UserData. This instructs CloudFormation to pause the status of the resource in CREATE_IN_PROGRESS until it receives the required number of signals or the timeout duration is reached.

Step-by-Step Solution

1
Define the application metadata and configuration script on the EC2 resource using the AWS::CloudFormation::Init key.
The instance metadata contains the configuration details, which will be processed by cfn-init.
This allows CloudFormation to manage packages, files, and services systematically on the EC2 instance.
2
Add a CreationPolicy attribute with a ResourceSignal count of 1 and a timeout configuration to the EC2 resource.
CloudFormation is instructed to pause resource creation and wait for a success signal before marking the instance as CREATE_COMPLETE.
This prevents CloudFormation from prematurely finishing stack creation before the software is operational.
3
Execute the cfn-signal helper script at the very end of the instance's UserData property, immediately after invoking cfn-init.
A success signal is sent to the CloudFormation endpoint once all setup steps successfully run.
This signals CloudFormation that the instance setup is successful, causing the resource status to transition to CREATE_COMPLETE.

Key Concept

Using CreationPolicy and helper scripts (cfn-init, cfn-signal) to synchronize resource provisioning inside AWS CloudFormation.
Estimated Time:1m 30s
Question 38Question →

A developer is updating an AWS CloudFormation stack that manages a web application's network infrastructure. The update fails, and the stack begins to roll back. However, the rollback process fails and the stack is left in the UPDATE_ROLLBACK_FAILED state because one of the subnets was previously deleted manually via the AWS Console. How should the developer resolve this issue to return the stack to a stable state?

Show answer & explanation

Answer: Use the ContinueUpdateRollback operation and choose to skip the deleted subnet resource during the rollback process, then manually clean up any remaining resources if necessary.

Answer

Use the ContinueUpdateRollback operation and choose to skip the deleted subnet resource during the rollback process, then manually clean up any remaining resources if necessary.
The correct approach is to run the ContinueUpdateRollback operation and specify the logical IDs of the resources to skip (in this case, the deleted subnet). CloudFormation will set the state of these resources to UPDATE_ROLLBACK_COMPLETE and continue rolling back the remaining resources in the stack. Once the stack reaches a stable state, the developer can update the template or manually recreate resources to align them.

Step-by-Step Solution

1
Identify the cause of the rollback failure
Confirm that the stack is in the UPDATE_ROLLBACK_FAILED state due to an out-of-band deletion of the subnet resource.
Before taking corrective action, the developer must verify which resource is blocking the rollback process.
2
Initiate the ContinueUpdateRollback operation
Start the rollback continuation process using the AWS Console, AWS CLI, or CloudFormation API.
This operation is required to force CloudFormation to attempt to complete the rollback again.
3
Specify resources to skip during rollback
Select the deleted subnet resource to be skipped.
Skipping the deleted resource allows CloudFormation to set its status to rolled back without attempting to modify the non-existent resource, bringing the stack to the stable UPDATE_ROLLBACK_COMPLETE state.

Key Concept

Handling CloudFormation stack update rollback failures caused by manual out-of-band resource deletion.
Estimated Time:1m 30s
Question 39Question →

A developer is managing an infrastructure deployment consisting of two separate AWS CloudFormation stacks: a network stack that exports VPC resource identifiers, and an application stack that imports these identifiers using the `Fn::ImportValue` intrinsic function. The developer needs to update the network stack's outputs to support a new subnet configuration. Which of the following are valid constraints or required actions when modifying exported outputs that are referenced by other stacks? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The network stack cannot be deleted, and its exported output values cannot be modified or deleted as long as they are referenced by the application stack.; To modify exported values in the network stack, the developer must first update the importing application stack to remove the references to those exports.

Answer

The network stack cannot be deleted, and its exported output values cannot be modified or deleted as long as they are referenced by the application stack; and to modify exported values in the network stack, the developer must first update the importing application stack to remove the references to those exports.
AWS CloudFormation enforces that you cannot delete a stack if its exported outputs are referenced by another stack, nor can you modify or delete any exported output value that is currently in use. To successfully change an exported value, the importing stack must first be updated to remove the reference to the export. Once the reference is removed, the exporting stack can be updated, and then the importing stack can be updated to reference the new export.

Step-by-Step Solution

1
Identify the dependency relationship between the two stacks, noting that the application stack imports values exported by the network stack.
Confirm that the network stack is the exporting stack and the application stack is the importing stack.
This establishes that the network stack outputs cannot be modified or deleted directly due to active external references.
2
Analyze how CloudFormation handles updates to exported values that are currently in use by other stacks.
Determine that CloudFormation will block any updates to the exporting stack that attempt to modify or delete the referenced outputs.
This is a core constraint of cross-stack references in AWS CloudFormation to prevent breaking dependent resources.
3
Formulate the correct remediation sequence to modify the subnet configuration output.
The developer must first update the application stack to remove the Fn::ImportValue references (e.g., by temporarily hardcoding the values or using another sharing mechanism), then update the network stack's outputs, and finally restore the references in the application stack.
This temporarily breaks the dependency lock, allowing the network stack update to proceed successfully.

Key Concept

AWS CloudFormation cross-stack references enforce strong dependencies, preventing the deletion of exporting stacks or modification of exported values until all referencing stacks remove their imports.
Estimated Time:2m 0s
Question 40Question →

A software engineering team is using AWS CloudFormation to deploy a three-tier web application. The application requires a database password that must be rotated automatically every 30 days. Which approach should the developer use to securely reference the database password in the CloudFormation template?

Show answer & explanation

Answer: Retrieve the password using a dynamic reference to AWS Secrets Manager directly within the resource properties in the template.

Answer

Retrieve the password using a dynamic reference to AWS Secrets Manager directly within the resource properties in the template.
Using a dynamic reference to AWS Secrets Manager is the recommended best practice for referencing sensitive data that changes dynamically, such as database credentials that rotate every 30 days. AWS Secrets Manager natively integrates with AWS Lambda to rotate credentials automatically and integrates with CloudFormation templates via dynamic references, preventing plaintext passwords from appearing in the template or stack configuration.

Step-by-Step Solution

1
Identify the requirement for automatic rotation of the database password.
AWS Secrets Manager is identified as the service that natively supports automatic rotation (using AWS Lambda) and integration with CloudFormation.
Systems Manager Parameter Store does not support native rotation schedules for secrets.
2
Determine the secure method to fetch the secret in CloudFormation.
Dynamic references using the 'resolve:secretsmanager' pattern are chosen.
This avoids hardcoding or passing parameters that could be exposed in console logs or template history.
3
Ensure the template avoids manual drift.
Using dynamic references allows CloudFormation to resolve the latest secret value dynamically during deployment operations without requiring manual resource modifications.
Out-of-band updates violate infrastructure-as-code principles.

Key Concept

Using AWS Secrets Manager dynamic references in AWS CloudFormation to secure and automatically rotate database credentials without introducing stack drift.
PreviousPage 2 / 3Next