AWS CloudFormation

57 questions

All types57 Multiple choice29 Multiple select28

A developer deployed an Amazon EC2 instance and an associated security group using an AWS CloudFormation stack. During a troubleshooting session, the developer manually added a new ingress rule to the security group using the AWS Management Console. The developer now wants to synchronize the CloudFormation stack with these changes to ensure future stack updates do not overwrite or fail due to this modification. Which action should the developer take to resolve this discrepancy?

Run drift detection on the stack to identify the modifications, update the CloudFormation template to include the new ingress rule, and then perform a stack update.

Perform a stack update using the original template, expecting AWS CloudFormation to automatically detect the manual configuration and merge it into the stack state.

Store the modified security group rules in AWS Systems Manager Parameter Store, and reference them via a dynamic reference in the template to bypass future drift detection.

Trigger a stack rollback operation to force the CloudFormation stack to import the manual out-of-band changes into its current state.

Show answer & explanation

Answer: Run drift detection on the stack to identify the modifications, update the CloudFormation template to include the new ingress rule, and then perform a stack update.

Answer

Run drift detection on the stack to identify the modifications, update the CloudFormation template to include the new ingress rule, and then perform a stack update.

The correct action is to first identify the drift using the drift detection feature of CloudFormation. Once the drift details are known, the developer must update the template to include the manual modifications and run a stack update. This synchronizes the template definition with the actual resource state without interrupting the service or overwriting the rule.

Step-by-Step Solution

Detect drift

Detailed drift status showing that the security group resource has drifted from its template definition due to the manually added ingress rule.

Before making changes, the exact differences between the template and the live resources must be identified.

Modify template

The CloudFormation template now contains the new ingress rule in the security group resource definition.

To resolve drift, the template must be updated to align with the desired live state of the resources.

Perform stack update

The stack state is updated, and the resource is marked as in-sync.

Running the stack update applying the updated template reconciles the template state with the physical resource state.

Key Concept

CloudFormation Drift Detection and Reconciliation

Estimated Time:1m 30s

Question 42Question →

A developer is using AWS CloudFormation to deploy a web application. The template requires a database password that must be retrieved securely without being hardcoded or exposed in plaintext. During the deployment testing phase, the developer also needs to ensure that if any resource fails to create or update, the stack does not automatically revert its changes, allowing the developer to investigate the failed resource state.

Which two actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Reference the database password in the template using the dynamic reference pattern for AWS Secrets Manager.

Specify the --disable-rollback parameter when executing the create-stack or update-stack command via the AWS CLI.

Reference the database password in the template using the dynamic reference pattern for a Systems Manager Parameter Store parameter of type String.

Manually delete the failed resource via the AWS Management Console and run drift detection to trigger CloudFormation to automatically recreate the resource.

Store the database password in Systems Manager Parameter Store using a standard String parameter type to optimize cost, and import it as a template parameter.

Show answer & explanation

Answer: Reference the database password in the template using the dynamic reference pattern for AWS Secrets Manager.; Specify the --disable-rollback parameter when executing the create-stack or update-stack command via the AWS CLI.

Answer

Reference the database password using the AWS Secrets Manager dynamic reference pattern, and specify the --disable-rollback parameter when executing the create-stack or update-stack command via the AWS CLI.

The correct options are referencing the database password using the dynamic reference pattern for AWS Secrets Manager and specifying the --disable-rollback parameter when executing the create-stack or update-stack command. AWS Secrets Manager dynamic references securely fetch credentials at deployment time without exposing them. The --disable-rollback parameter prevents the stack from automatically reverting on failure, preserving the resource state for troubleshooting.

Step-by-Step Solution

Secure the database password by storing it in AWS Secrets Manager.

The password is encrypted and managed centrally, avoiding hardcoding.

AWS Secrets Manager is designed for storing sensitive secrets and credentials.

Update the CloudFormation template to reference the secret using the dynamic reference syntax: resolve:secretsmanager:secret-id.

CloudFormation retrieves the password dynamically at runtime during stack operations.

This prevents sensitive data from being recorded in the template or stack history.

Execute the stack creation or update command with the --disable-rollback CLI option.

If a deployment failure occurs, the stack remains in a failed state rather than rolling back.

This allows the developer to inspect the state and logs of the failed resources directly.

Key Concept

AWS CloudFormation secure parameter resolution and deployment troubleshooting

Question 43Question →

A developer is maintaining an application stack deployed via AWS CloudFormation. A recent stack update failed because a Security Group managed by the stack was manually deleted via the Amazon EC2 console, causing the stack rollback to fail. The stack is currently stuck in the UPDATE_ROLLBACK_FAILED state. The developer needs to return the stack to a stable state so they can apply a new template. Which two actions must the developer perform to resolve this issue? (Select TWO.)

Select all that apply

Invoke the ContinueUpdateRollback operation from the AWS CloudFormation console or CLI.

Recreate the manually deleted Security Group with the exact same physical name, or specify the resource to be skipped in the ResourcesToSkip parameter during the rollback continuation.

Initiate a new stack update directly using the UpdateStack API with the --disable-rollback parameter enabled.

Run drift detection on the stack and select the 'Auto-Reconcile' option to let CloudFormation automatically recreate the missing Security Group.

Retrieve the Security Group's configuration parameters from AWS Systems Manager Parameter Store using a dynamic reference to force-refresh the template state.

Show answer & explanation

Answer: Invoke the ContinueUpdateRollback operation from the AWS CloudFormation console or CLI.; Recreate the manually deleted Security Group with the exact same physical name, or specify the resource to be skipped in the ResourcesToSkip parameter during the rollback continuation.

Answer

To resolve the UPDATE_ROLLBACK_FAILED state, the developer must continue the rollback using the ContinueUpdateRollback operation and either recreate the manually deleted Security Group or specify it as a resource to skip during rollback.

To resolve the UPDATE_ROLLBACK_FAILED state, the developer must continue the rollback using the ContinueUpdateRollback operation. Because the failure was caused by a manually deleted resource (the Security Group), the rollback cannot proceed unless the developer either recreates the resource with the exact same physical ID/name so the rollback process can delete or modify it, or explicitly skips the resource using the ResourcesToSkip parameter.

Step-by-Step Solution

Analyze the cause of the rollback failure

Identify that the rollback failed because a Security Group managed by the stack was deleted out-of-band.

CloudFormation attempts to clean up or modify the Security Group during rollback, but cannot find it, causing the rollback to fail.

Perform remedial action on the deleted resource

Either recreate the Security Group manually with the exact configuration and physical name, or prepare to skip it during rollback.

This satisfies CloudFormation's expectation of the resource's existence or instructs CloudFormation to ignore it, allowing the rollback to proceed.

Trigger ContinueUpdateRollback

Run the continue-update-rollback CLI command (or use the console) specifying the ResourcesToSkip if skipping.

This transitions the stack from UPDATE_ROLLBACK_FAILED back to a stable UPDATE_ROLLBACK_COMPLETE state, enabling future updates.

Key Concept

Resolving UPDATE_ROLLBACK_FAILED state in AWS CloudFormation

Question 44Question →

A developer is writing an AWS CloudFormation template to deploy an application on Amazon EC2. The application requires two configurations: a database connection password that is sensitive and must be rotated automatically every 30 days, and an environment-specific application logging level (e.g., DEBUG or INFO) that is non-sensitive and updated frequently. Which configuration strategy should the developer implement in the template to meet these requirements securely and cost-effectively?

Store the database password in AWS Secrets Manager and reference it using a dynamic reference. Store the logging level in Systems Manager Parameter Store and reference it using a Parameter Store dynamic reference.

Store both the database password and the application logging level in AWS Secrets Manager, and reference both using Secrets Manager dynamic references.

Store both the database password and the application logging level in Systems Manager Parameter Store, and reference both using Parameter Store parameters with the SecureString type.

Deploy the EC2 instance using dummy values in the template, and then manually configure the password and logging level directly on the deployed resources after stack creation.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it using a dynamic reference. Store the logging level in Systems Manager Parameter Store and reference it using a Parameter Store dynamic reference.

Answer

The correct strategy is to store the sensitive database password requiring automatic rotation in AWS Secrets Manager and reference it via dynamic references, while using Systems Manager Parameter Store for the non-sensitive logging level configuration. This aligns with AWS security best practices and cost optimization recommendations.

Step-by-Step Solution

Identify the security and rotation requirements for the database password.

The database password is sensitive and requires automatic rotation every 30 days, which is a native feature of AWS Secrets Manager.

Secrets Manager provides secure storage, built-in rotation integration for databases, and dynamic reference integration with CloudFormation.

Identify the requirements for the application logging level setting.

The logging level is non-sensitive, changes frequently, and does not require rotation.

Systems Manager Parameter Store is designed for configuration data and is more cost-effective than Secrets Manager for non-sensitive data.

Select the correct CloudFormation referencing mechanisms for both resources.

Reference the database password using a Secrets Manager dynamic reference and the logging level using a Parameter Store dynamic reference.

This combined approach maximizes security for secrets while optimizing costs for non-sensitive parameters.

Key Concept

CloudFormation dynamic references for AWS Secrets Manager and Systems Manager Parameter Store

Question 45Question →

A developer is managing an AWS CloudFormation stack for a web application. The application requires a database password that must be rotated automatically every 30 days. During a stack update to modify the application configuration, a database connection error causes the update to fail, leaving the stack stuck in the UPDATE_ROLLBACK_FAILED state. Which combination of actions should the developer take to securely retrieve the database password in the template and resolve the failed stack update?

Reference the database password in the template using a dynamic reference to AWS Secrets Manager, resolve the database connection issue, and run the ContinueUpdateRollback command.

Reference the database password in the template using a dynamic reference to AWS Systems Manager Parameter Store, resolve the database connection issue, and run the ContinueUpdateRollback command.

Reference the database password in the template using a dynamic reference to AWS Secrets Manager, resolve the database connection issue, and immediately run a new UpdateStack operation to force the stack out of the rollback state.

Reference the database password in the template using a dynamic reference to AWS Secrets Manager, manually update the credentials in the Amazon RDS console to bypass the rollback failure, and run a stack update.

Show answer & explanation

Answer: Reference the database password in the template using a dynamic reference to AWS Secrets Manager, resolve the database connection issue, and run the ContinueUpdateRollback command.

Answer

Reference the database password in the template using a dynamic reference to AWS Secrets Manager, resolve the database connection issue, and run the ContinueUpdateRollback command.

The correct answer combines retrieving rotated secrets using Secrets Manager dynamic references with recovering a stuck stack using the ContinueUpdateRollback command. Secrets Manager supports automatic secret rotation, and dynamic references securely fetch these secrets without exposing them. When a stack is in the UPDATE_ROLLBACK_FAILED state, it cannot be updated directly; the underlying issue must be fixed, and ContinueUpdateRollback must be run to complete the rollback to a stable state.

Step-by-Step Solution

Select the correct secrets retrieval mechanism.

Identify that AWS Secrets Manager supports dynamic references and automatic rotation, unlike Parameter Store which is not designed for native secret rotation.

The requirement specifies that the database password must be rotated automatically every 30 days.

Identify the mechanism to resolve the stack rollback failure.

Determine that a stack stuck in UPDATE_ROLLBACK_FAILED cannot be updated directly and requires a ContinueUpdateRollback operation after fixing the underlying resource issue.

CloudFormation blocks new stack updates until the stack returns to a stable state (e.g., UPDATE_ROLLBACK_COMPLETE).

Key Concept

AWS CloudFormation Stack Rollback Resolution and Secrets Management Integration

Question 46Question →

A developer is deploying a multi-tier application using an AWS CloudFormation template. The template defines an Amazon RDS DBInstance that contains critical production data. To ensure data safety and prevent downtime, the developer must meet two requirements:

1. Prevent the database instance from being deleted when the CloudFormation stack is deleted.
2. Prevent the database instance from being accidentally updated or replaced during stack updates, while still allowing other stack resources to be updated.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template.

Define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.

Set the UpdateReplacePolicy attribute of the DBInstance resource to Delete in the template.

Manually enable deletion protection on the RDS DBInstance using the AWS Console, then run drift detection to update the stack state.

Store the database configuration parameters in Systems Manager Parameter Store and set a CloudFormation stack policy to restrict access to the parameter path.

Show answer & explanation

Answer: Set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template.; Define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.

Answer

The developer should set the DeletionPolicy attribute of the DBInstance resource to Retain in the CloudFormation template, and define a Stack Policy containing an explicit Deny statement for Update actions on the DBInstance resource.

To satisfy the requirements, the developer must configure both DeletionPolicy and a Stack Policy. Setting the DeletionPolicy to Retain ensures that the RDS DBInstance is kept when the stack is deleted. Applying a Stack Policy with an explicit Deny for Update actions on the DBInstance resource prevents it from being modified or replaced during stack updates, while still allowing other stack resources to be updated.

Step-by-Step Solution

Identify the mechanism to prevent resource deletion upon stack deletion.

Determine that setting the DeletionPolicy attribute to Retain in the template ensures the DBInstance persists even if the CloudFormation stack is deleted.

By default, deleting a stack deletes all of its resources. The DeletionPolicy attribute allows overriding this behavior for specific resources.

Identify the mechanism to prevent resource updates or replacement during stack updates.

Determine that applying a Stack Policy with an explicit Deny statement for Update actions on the DBInstance prevents accidental updates or replacements during stack updates.

Stack policies define update permissions for stack resources. Applying an explicit Deny on the DBInstance prevents modifications to it, while allowing other stack resources to update normally.

Key Concept

AWS CloudFormation Resource Lifecycle Protection

Estimated Time:1m 30s

Question 47Question →

A development team uses AWS CloudFormation to manage a serverless application consisting of Amazon DynamoDB tables and AWS Lambda functions. The application requires a database API key that must be rotated every 30 days. Additionally, a developer recently modified the read capacity units of one of the DynamoDB tables directly in the AWS Management Console to handle a temporary traffic spike. The team now needs to perform a stack update to deploy new application logic while addressing both the rotation requirement and the manual configuration changes.

Which of the following actions should the team take to meet these requirements? (Select TWO.)

Select all that apply

Store the database API key in AWS Secrets Manager, configure automatic rotation for the secret, and reference the secret in the CloudFormation template using a dynamic reference.

Store the database API key in AWS Systems Manager Parameter Store as a SecureString parameter, and configure automatic rotation directly within the Parameter Store console.

Perform drift detection on the CloudFormation stack, identify the modified DynamoDB read capacity properties, and update the CloudFormation template or the resource to resolve the drift before updating the stack.

Execute the stack update using the AWS CLI with the --force-update-stack option to automatically overwrite any manual out-of-band resource modifications.

Store the database API key as a secure parameter in Systems Manager Parameter Store, and use the ssm-secure dynamic reference in the template to trigger automatic rotation every 30 days.

Show answer & explanation

Answer: Store the database API key in AWS Secrets Manager, configure automatic rotation for the secret, and reference the secret in the CloudFormation template using a dynamic reference.; Perform drift detection on the CloudFormation stack, identify the modified DynamoDB read capacity properties, and update the CloudFormation template or the resource to resolve the drift before updating the stack.

Answer

Store the database API key in AWS Secrets Manager with automatic rotation enabled, reference it via a dynamic reference in the template, and run drift detection to identify and reconcile the manual DynamoDB configurations before updating the stack.

Storing the API key in AWS Secrets Manager is correct because Secrets Manager natively supports automatic rotation of secrets and allows safe retrieval via dynamic references in CloudFormation templates. Performing drift detection on the stack is correct because it identifies manual out-of-band changes, allowing the developer to align the template or resource state before applying the stack update, preventing update failures.

Step-by-Step Solution

Evaluate the secret storage and rotation requirement.

Determine that AWS Secrets Manager must be used because it provides built-in automatic rotation capabilities, unlike Systems Manager Parameter Store, and can be resolved in templates via dynamic references.

Parameter Store does not natively support automated secrets rotation, making Secrets Manager the correct choice.

Address the configuration drift from the manual out-of-band modifications.

Detect drift using CloudFormation drift detection, identify the difference in DynamoDB read capacity units, and update either the CloudFormation template or the resource to resolve the drift.

Updating a stack with out-of-band modifications can result in deployment failures or unintended resource configurations unless the template is synchronized with the actual state.

Key Concept

Managing secrets with rotation and handling resource drift in AWS CloudFormation.

Question 48Question →

A developer uses AWS CloudFormation to manage an application's infrastructure. An administrator manually modified the inbound rules of a security group associated with an Amazon EC2 instance using the AWS Management Console to resolve a temporary connection issue. The developer runs a drift detection status check on the stack, and the security group is flagged as DRIFTED. Which action should the developer take to resolve the drift and ensure the resource configuration is correctly aligned with the CloudFormation template?

Revert the manual changes in the security group directly via the Amazon EC2 console to match the template, or update the template to include the modified rules and run a stack update.

Execute the aws cloudformation update-stack command with the --resolve-drift parameter to automatically sync the live configuration back to the template's specification.

Delete the drifted security group resource from the AWS Management Console, and trigger a stack update with rollback disabled to force CloudFormation to recreate it.

Create a new AWS Secrets Manager secret containing the updated security group rules, and reference the secret using a dynamic reference in the CloudFormation template.

Show answer & explanation

Answer: Revert the manual changes in the security group directly via the Amazon EC2 console to match the template, or update the template to include the modified rules and run a stack update.

Answer

Revert the manual changes in the security group directly via the Amazon EC2 console to match the template, or update the template to include the modified rules and run a stack update.

To resolve drift on a resource managed by CloudFormation, you must either revert the manual out-of-band changes directly in the resource's service console (or via CLI) so it matches the template configuration, or update the CloudFormation template to match the drifted state and perform a stack update to sync the stack status.

Step-by-Step Solution

Identify the drifted properties of the resource using the drift detection details in the AWS CloudFormation console.

The differences between the expected template configuration and the actual live configuration of the security group are revealed.

This allows the developer to pinpoint exactly which rules were modified, added, or deleted out-of-band.

Decide whether to keep the manual changes or revert them.

A plan is made to either rollback the manual console edits or update the template to adopt them permanently.

Resolving drift requires aligning the expected template definition with the physical resource state.

Perform the alignment action by either manually updating the security group rules in the EC2 Console to match the template, or updating the CloudFormation template to match the new rules followed by a stack update.

The resource configuration matches the template, and subsequent drift detection checks will report the resource as IN_SYNC.

This establishes a clean baseline for future CloudFormation deployments and prevents deployment failures.

Key Concept

CloudFormation Drift Detection and Resolution

Question 49Question →

A developer is writing an AWS CloudFormation template to deploy a web application on an Amazon EC2 instance. The application requires a database password that needs automatic rotation, as well as several software packages. The developer wants to ensure that any updates to the software configuration in the template are automatically applied to the instance without replacing it.

Which two actions should the developer take to meet these requirements?

Select all that apply

Define the software configuration in the AWS::CloudFormation::Init resource metadata, run cfn-init in the UserData property to perform the initial installation, and configure the cfn-hup daemon to monitor changes.

Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Store the database password in Systems Manager Parameter Store and retrieve it via a dynamic reference, utilizing its native scheduled parameter rotation features.

Install the packages by writing custom scripts in the EC2 UserData property, and instruct administrators to manually update the instance via SSH when template configurations change.

Execute the cfn-init script with the --rollback flag in UserData to monitor the stack status and roll back configuration files if a stack update enters the ROLLBACK_IN_PROGRESS state.

Show answer & explanation

Answer: Define the software configuration in the AWS::CloudFormation::Init resource metadata, run cfn-init in the UserData property to perform the initial installation, and configure the cfn-hup daemon to monitor changes.; Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Answer

Use the AWS::CloudFormation::Init resource metadata along with the cfn-init script and cfn-hup daemon to install and update software configurations, and use AWS Secrets Manager with dynamic references to securely store and automatically rotate the database password.

The correct options involve configuring the software installation using the CloudFormation metadata framework (AWS::CloudFormation::Init, cfn-init, and cfn-hup) to detect and apply updates automatically, and using AWS Secrets Manager to retrieve rotated database passwords dynamically.

Step-by-Step Solution

Select the appropriate storage for secret parameters that require rotation.

Identify AWS Secrets Manager as the solution because it supports automatic rotation of credentials, unlike Systems Manager Parameter Store.

Ensures the database password is secure and complies with security requirements for rotation.

Select the mechanism for applying and updating EC2 packages without recreating the instance.

Combine AWS::CloudFormation::Init, the cfn-init helper script in UserData, and the cfn-hup daemon running on the instance.

This configuration allows the instance to pull metadata changes and apply updates dynamically.

Key Concept

AWS CloudFormation helper scripts and dynamic references for secret management.

Question 50Question →

A developer is deploying a three-tier web application using an AWS CloudFormation template. The template defines an Amazon RDS DB instance that requires database credentials. The company's security policy requires that database passwords must be stored securely, rotated every 30 days, and retrieved dynamically during stack operations. Additionally, the developer must ensure that any failed stack updates automatically revert to the last stable state without leaving orphaned resources or requiring manual intervention. Which two actions should the developer take to meet these security and deployment requirements? (Select TWO.)

Select all that apply

Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format.

Rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.

Store the database password in Systems Manager Parameter Store as a standard String parameter and use the Ref intrinsic function to retrieve the password.

If a stack update fails and enters the UPDATE_ROLLBACK_FAILED state, immediately execute another update stack command with a corrected template to clear the status.

Manually delete the resources that failed to update using the AWS Management Console to force the stack to bypass the rollback phase.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format.; Rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.

Answer

Store the database password in AWS Secrets Manager and reference it in the CloudFormation template using a dynamic reference format, and rely on CloudFormation's automatic rollback on update failure, which reverts modified resources to their previous configuration and returns the stack to the UPDATE_ROLLBACK_COMPLETE state.

Storing database credentials in AWS Secrets Manager and referencing them using dynamic references satisfies the credential security and 30-day rotation policy while keeping passwords out of plaintext template properties. Relying on default CloudFormation update rollbacks ensures that stack updates that fail revert all affected resources back to their original stable configurations automatically.

Step-by-Step Solution

Select AWS Secrets Manager as the secure vault for credentials.

The database password is created and stored in AWS Secrets Manager, allowing automatic 30-day rotation configurations.

Parameter Store does not support automatic rotation natively, making Secrets Manager the compliant choice for rotated secrets.

Integrate the secret reference into the CloudFormation template using dynamic references.

CloudFormation retrieves the password dynamically at runtime during stack operations without exposing the password in template files.

Dynamic references are resolved only during resource provisioning and keep plaintext passwords out of templates and outputs.

Determine the automatic rollback strategy on deployment failure.

The rollback mechanism reverts stack resources back to their pre-update state, returning the stack to UPDATE_ROLLBACK_COMPLETE on failure.

This behavior prevents orphan resources and returns the infrastructure configuration to the last known stable state.

Key Concept

AWS CloudFormation deployment lifecycle controls stack update rollbacks and integrates with AWS Secrets Manager via dynamic references to handle rotated secrets securely.

Estimated Time:2m 0s

Question 51Question →

A development team manages their application infrastructure using an AWS CloudFormation stack. A developer needs to update the stack to change the instance type of an Amazon EC2 instance. However, drift detection reveals that the security group attached to the EC2 instance was manually modified out-of-band in the AWS Management Console to allow traffic on port $8080$ . In addition, the developer needs to reference a database password that must be automatically rotated.

Which combination of steps should the developer take to resolve the drift and retrieve the password securely and cost-effectively? (Select TWO.)

Select all that apply

Update the CloudFormation template to match the drifted security group configuration (allowing port

8080

) before proceeding with the stack update.

Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Perform the stack update with the drift synchronization option enabled to automatically rewrite the CloudFormation template based on the live resource configuration.

Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Systems Manager Parameter Store.

Initiate a stack update rollback using the AWS Command Line Interface (AWS CLI) to revert the drifted security group rules to their template-defined values.

Show answer & explanation

Answer: Update the CloudFormation template to match the drifted security group configuration (allowing port $8080$ ) before proceeding with the stack update.; Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

Answer

Update the CloudFormation template to match the drifted security group configuration before proceeding with the stack update, and use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.

To resolve the configuration drift where port

8080

was manually allowed, the developer must update the template to match this state before performing subsequent updates. Additionally, retrieving an automatically rotated database credential is best achieved by storing the credential in AWS Secrets Manager and accessing it using a dynamic reference in the template.

Step-by-Step Solution

Analyze the drift detection results for the security group resource.

Identify that port

8080

was manually allowed out-of-band.

Before performing stack updates, drift must be resolved to prevent update failures or configuration overwrites.

Modify the CloudFormation template to include the port

8080

configuration in the security group resource definition.

The template now matches the live resource configuration.

This aligns the template with the drifted state, resolving the drift status.

Implement a dynamic reference using the Secrets Manager resolver pattern in the template to access the database password.

The template references the secret securely without hardcoding it.

Secrets Manager provides native support for automated credential rotation, unlike Systems Manager Parameter Store.

Key Concept

CloudFormation drift resolution and dynamic references for rotated secrets

Question 52Question →

A developer is creating an AWS CloudFormation template to deploy a web application. The application requires access to two configuration values:

1. A database connection password that must support automatic rotation every 30 days.
2. A public API endpoint URL for a third-party service that is non-sensitive and updated infrequently.

To follow security best practices and optimize costs, how should the developer store and reference these values in the CloudFormation template?

Store both the database password and the API endpoint URL in AWS Secrets Manager, and reference both using Secrets Manager dynamic references.

Store both the database password and the API endpoint URL in AWS Systems Manager Parameter Store as SecureString parameters, and reference both using Parameter Store dynamic references.

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Hardcode both the database password and the API endpoint URL as default values in the template's Parameters section, and update them manually in the AWS Console after deployment.

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference. Store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Answer

Store the database password in AWS Secrets Manager and reference it using a Secrets Manager dynamic reference, and store the API endpoint URL in AWS Systems Manager Parameter Store as a String parameter and reference it using a Parameter Store dynamic reference.

Storing the database password in AWS Secrets Manager and referencing it via a dynamic reference satisfies the security and automatic rotation requirements. Storing the non-sensitive public API endpoint URL in Systems Manager Parameter Store standard parameters satisfies the cost-efficiency constraint because Parameter Store standard parameters are free, and using a dynamic reference allows secure integration without exposure.

Step-by-Step Solution

Determine the storage requirements for the database password.

The password requires automatic rotation every 30 days, which points to AWS Secrets Manager as the appropriate service because it integrates with AWS Lambda for automated credential rotation.

Systems Manager Parameter Store does not offer native automatic rotation for secrets.

Determine the storage requirements for the non-sensitive public API endpoint.

The endpoint URL is non-sensitive and updated infrequently, making Systems Manager Parameter Store standard parameters the most cost-effective choice since they are free.

Using Secrets Manager for non-sensitive data incurs unnecessary monthly costs.

Identify the proper CloudFormation integration method.

Use dynamic references to resolve the values dynamically at runtime (e.g., {{resolve:secretsmanager:...}} and {{resolve:ssm:...}}).

Dynamic references allow CloudFormation to securely retrieve external values during deployment without hardcoding them in the template.

Key Concept

Selecting and referencing the appropriate parameter store or secrets service in CloudFormation based on security, rotation, and cost requirements.

Estimated Time:1m 30s

Question 53Question →

A developer is deploying updates to an AWS CloudFormation stack. The update fails due to a configuration error, initiating an automatic rollback. However, the rollback fails because a security group managed by the stack was manually attached to an EC2 instance outside of CloudFormation, placing the stack in the UPDATE_ROLLBACK_FAILED state. The developer needs to successfully complete the rollback and return the stack to a stable state. Which action should the developer take to resolve this issue?

Run the drift detection tool on the stack, select the drifted security group, and choose the 'Import drifted resource state' option to force the template to sync with the manual changes.

Modify the CloudFormation template to delete the security group definition, and run a new stack update command with the '--force-update' flag to overwrite the active rollback status.

Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.

Create an Amazon EC2 launch template containing the security group, store the launch template ID in AWS Systems Manager Parameter Store as a parameter of type String, and reference it to force-complete the rollback.

Show answer & explanation

Answer: Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.

Answer

Execute the 'Continue update rollback' operation, specifying the blocked security group as a resource to skip, and then manually remove the out-of-band association after the rollback completes.

When a resource deletion blocks a stack rollback, the correct procedure is to use the 'Continue update rollback' operation. This action allows the developer to skip the specific resource that is failing to roll back. CloudFormation will mark that resource's state as skipped and proceed to complete the rollback for the rest of the stack, bringing it back to a stable UPDATE_ROLLBACK_COMPLETE status. Afterward, the developer must manually clean up the skipped resource.

Step-by-Step Solution

Identify the cause of the rollback failure.

Determine that the security group cannot be deleted because it is still in use by an out-of-band EC2 instance.

You must identify which resource is blocking the rollback before deciding on the recovery path.

Use the CloudFormation console or AWS CLI to execute the 'Continue update rollback' action.

Specify the security group in the list of resources to skip during the rollback operation.

Skipping the blocked resource allows CloudFormation to successfully complete the rollback process for all other resources, transitioning the stack to the UPDATE_ROLLBACK_COMPLETE state.

Perform manual remediation of the skipped resource.

Manually detach the security group from the out-of-band EC2 instance and clean up the association.

Since the resource was skipped, it remains in its current state and must be manually aligned with the desired state once the stack is stable.

Key Concept

Resolving UPDATE_ROLLBACK_FAILED states by skipping blocked resources during the Continue Update Rollback operation.

Question 54Question →

An application deployed via an AWS CloudFormation stack requires a database password that must be rotated automatically every 30 days. Additionally, operators occasionally make direct manual changes to the security group rules associated with the stack, which causes drift between the physical resources and the template definition. Which two actions should the developer take to manage these requirements?

Select all that apply

Store the password in AWS Secrets Manager, enable automatic rotation, and reference the password in the CloudFormation template using a dynamic reference.

Use AWS CloudFormation drift detection to identify manual modifications, and then update the template or resource properties to align with the actual state.

Store the password in AWS Systems Manager Parameter Store as a SecureString parameter, and configure automatic rotation directly in the Parameter Store console.

Perform the stack update with the AWS CLI using the --ignore-drift parameter to allow CloudFormation to overwrite any manual resource modifications.

Run the AWS CLI command aws cloudformation rollback-stack when a stack update fails to automatically overwrite the out-of-band changes.

Show answer & explanation

Answer: Store the password in AWS Secrets Manager, enable automatic rotation, and reference the password in the CloudFormation template using a dynamic reference.; Use AWS CloudFormation drift detection to identify manual modifications, and then update the template or resource properties to align with the actual state.

Answer

To securely manage the password and handle out-of-band configuration changes, the developer should store the password in AWS Secrets Manager with automatic rotation enabled and reference it in the CloudFormation template using dynamic references. In addition, the developer should use AWS CloudFormation drift detection to identify manual modifications and update the template or resource properties to align them.

The correct approach involves using AWS Secrets Manager to store the database password with automatic rotation and reference it securely in CloudFormation using dynamic references. Additionally, using CloudFormation drift detection helps developers identify out-of-band modifications to resources and synchronize the stack configuration, avoiding deployment failures.

Step-by-Step Solution

Determine the storage and rotation method for the password.

AWS Secrets Manager is selected because it supports automatic rotation natively, unlike Systems Manager Parameter Store.

Satisfies the security requirement for automatic 30-day rotation.

Reference the stored password in the CloudFormation template.

Use dynamic references to retrieve the password from Secrets Manager at deployment time.

Avoids hardcoding sensitive passwords in the CloudFormation template.

Resolve resource drift caused by manual changes.

Run drift detection on the stack to identify differences, and update the template or import the actual resources to align them.

Prevents future stack updates from failing due to conflicts with manual modifications.

Key Concept

AWS CloudFormation Drift Detection and AWS Secrets Manager Dynamic References

Question 55Question →

A developer deployed an Amazon EC2 instance and an associated security group using an AWS CloudFormation stack. Later, a network administrator manually added an inbound rule allowing TCP port 3389 (RDP) directly via the Amazon VPC Console to troubleshoot a connection issue. The developer runs drift detection on the stack and confirms that the security group is in a drifted state. The developer wants to restore the security group to the exact configuration defined in the CloudFormation template. Which of the following is the correct method to resolve this drift?

Perform a stack update using the original CloudFormation template to force CloudFormation to overwrite the out-of-band changes and remove the RDP rule.

Initiate a stack rollback to the previous successful stack status to automatically revert the out-of-band security group changes.

Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Store the security group configuration in Systems Manager Parameter Store and enable automatic rotation to overwrite any out-of-band changes.

Show answer & explanation

Answer: Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Answer

Manually remove the unauthorized inbound RDP rule from the security group using the AWS Management Console or AWS CLI to match the expected template configuration.

Manually removing the out-of-band RDP rule is the correct way to resolve the drift. When a resource is modified out-of-band, CloudFormation drift detection flags the difference but does not automatically remediate it. To resolve the drift without changing the template, the resource must be manually modified to align back with the template definition.

Step-by-Step Solution

Analyze the source of the configuration drift.

Identify that the security group has an extra inbound RDP rule added manually.

To determine how the live resource differs from the CloudFormation template definition.

Evaluate whether a standard stack update using the original template can remediate the drift.

Determine that running an update with the same template does not overwrite manual changes because CloudFormation checks template differences, not live resource differences.

To rule out stack updates as an automatic remediation tool for unmodified templates.

Manually remove the unauthorized inbound RDP rule.

The security group configuration matches the CloudFormation template, resolving the drift.

To successfully restore the stack's resources to their expected template-defined state.

Key Concept

AWS CloudFormation Drift Detection and Remediation

Question 56Question →

A developer is writing an AWS CloudFormation template to deploy an Amazon EC2 instance that runs a web server. The developer wants to ensure that the EC2 instance is not marked as CREATE_COMPLETE until the web server application package is successfully installed and the service is started. If the installation fails or does not complete within 15 minutes, the stack creation should fail and rollback. Which TWO actions must the developer perform in the CloudFormation template and instance configuration to meet these requirements?

Select all that apply

Add a CreationPolicy attribute to the EC2 instance resource in the template and set the timeout property to 15 minutes.

Add an UpdatePolicy attribute to the EC2 instance resource in the template to define the wait time for the initial creation signals.

Execute the cfn-signal helper script in the instance's UserData after the installation and startup commands succeed.

Run the cfn-hup daemon inside UserData to monitor the installation logs and automatically trigger stack rollback on failure.

Retrieve a signal token by referencing a Systems Manager parameter using a Secrets Manager dynamic reference format in the UserData.

Show answer & explanation

Answer: Add a CreationPolicy attribute to the EC2 instance resource in the template and set the timeout property to 15 minutes.; Execute the cfn-signal helper script in the instance's UserData after the installation and startup commands succeed.

Answer

To meet the requirements, the developer must add a CreationPolicy attribute to the EC2 instance resource with a timeout of 15 minutes, and execute the cfn-signal helper script in the instance's UserData after the installation and startup commands succeed.

The correct actions are adding a CreationPolicy attribute to the EC2 instance resource in the template and executing the cfn-signal helper script in the instance's UserData. The CreationPolicy tells CloudFormation to wait for a signal before marking the instance as successfully created, and the cfn-signal script transmits that signal from the EC2 instance after setup steps finish.

Step-by-Step Solution

Identify the mechanism CloudFormation uses to pause stack creation for resource initialization.

The CreationPolicy attribute is used to block resource completion until a success signal is received.

This prevents the EC2 instance from transitioning to CREATE_COMPLETE immediately after VM provisioning.

Determine the tool used inside the EC2 instance to send the initialization status to CloudFormation.

The cfn-signal helper script is executed at the end of the bootstrap script (UserData).

This sends the success or failure signal back to AWS CloudFormation, satisfying the CreationPolicy wait condition.

Key Concept

AWS CloudFormation CreationPolicy and Helper Scripts

Estimated Time:2m 0s

Question 57Question →

A company is updating an infrastructure stack deployed via AWS CloudFormation. The template contains an Amazon DynamoDB table that needs to be modified. The planned modification requires CloudFormation to replace the DynamoDB resource. The developer wants to ensure that the database's existing data is preserved and the resource is not deleted during this replacement, as well as if the stack is deleted in the future. Which configuration should the developer apply to the DynamoDB resource in the template?

Specify only DeletionPolicy with the Retain value, as this attribute automatically applies to both resource replacement updates and stack deletions.

Apply an UpdatePolicy attribute with the AutoSnapshot property set to true, and set the DeletionPolicy to Retain.

Specify both DeletionPolicy and UpdateReplacePolicy with the Retain value in the resource attributes.

Enable stack termination protection and configure a Systems Manager Parameter Store parameter to track the resource state.

Show answer & explanation

Answer: Specify both DeletionPolicy and UpdateReplacePolicy with the Retain value in the resource attributes.

Answer

Specify both DeletionPolicy and UpdateReplacePolicy with the Retain value in the resource attributes.

To protect a resource from being deleted during both stack updates (when a change requires resource replacement) and stack deletion, you must specify both the DeletionPolicy and UpdateReplacePolicy attributes and set their values to Retain (or Snapshot if supported). Setting DeletionPolicy only protects the resource when the stack is deleted or the resource is removed from the template, but does not prevent deletion of the old resource during a replacement update. UpdateReplacePolicy specifically controls the behavior when a resource is replaced during a stack update.

Step-by-Step Solution

Analyze the resource modification requirements in the AWS CloudFormation template.

Identify that the modification to the Amazon DynamoDB table will trigger a resource replacement during a stack update.

Certain property updates (such as changing a partition key) cannot be applied to an existing DynamoDB table and require CloudFormation to create a new table and delete the old one.

Evaluate resource protection attributes for both stack updates and stack deletion.

Determine that DeletionPolicy only protects resources when the stack is deleted or when the resource is removed from the template, while UpdateReplacePolicy protects resources when they are replaced during updates.

Using only DeletionPolicy would result in the deletion of the old DynamoDB table when it is replaced during a stack update.

Apply both attributes to the resource definition in the template.

Configure DeletionPolicy: Retain and UpdateReplacePolicy: Retain on the DynamoDB table resource.

This combination ensures the table is preserved (retained in the AWS account) during both resource replacement updates and stack deletion.

Key Concept

Managing resource lifecycle and preserving data during AWS CloudFormation stack updates and deletions using DeletionPolicy and UpdateReplacePolicy.

PreviousPage 3 / 3

AWS CloudFormation

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Answer

Step-by-Step Solution

Key Concept

Common Mistakes