Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

An enterprise deploys its core e-commerce application on Amazon EC2 instances within an Auto Scaling group (ASG) using AWS CloudFormation. Recently, engineers manually modified several security groups associated with the ASG, leading to configuration drift and subsequent deployment failures during CloudFormation stack updates. Additionally, during a rapid scale-out event, the ASG launched multiple instances that were immediately added to the Application Load Balancer (ALB) target group before their local bootstrapping scripts finished installing required packages, resulting in transient HTTP 502 errors for clients. A Solutions Architect must design an automated solution to remediate the configuration drift and ensure newly launched instances do not receive traffic until bootstrapping completes successfully. Which two actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Configure an Auto Scaling group lifecycle hook for the EC2_INSTANCE_LAUNCHING transition. Modify the EC2 user data script to perform the bootstrapping tasks, and upon successful completion, execute the complete-lifecycle-action CLI command to transition the instance to the InService state.Answer
  2. Deploy the AWS Config managed rule cloudformation-stack-drift-detection-check to monitor the stack. Configure an Amazon EventBridge rule to detect non-compliant status events and trigger an AWS Systems Manager Automation runbook to remediate the drifted resources.Answer
  3. C
    Increase the Auto Scaling group cooldown period and configure the Application Load Balancer health check grace period to exceed the maximum package installation time of the bootstrapping script.
  4. D
    Attach a Service Control Policy (SCP) at the Organization root that denies the cloudformation:UpdateStack API action to all users, forcing all updates to go through the central CI/CD pipeline.
  5. E
    Configure a Systems Manager State Manager association to remediate drift by retrieving the golden configuration templates from a centralized Amazon S3 bucket, decrypting the templates using the default AWS-managed KMS key (aws/s3) shared across accounts.

Answer

To resolve these issues, configure an Auto Scaling lifecycle hook to pause the EC2_INSTANCE_LAUNCHING state while user data completes bootstrapping and signals completion, and utilize AWS Config stack drift detection integrated with Amazon EventBridge and AWS Systems Manager Automation to detect and remediate infrastructure resource drift.
The correct architecture uses an Auto Scaling lifecycle hook to hold the instance in a launching state, allowing the user data script to perform bootstrapping tasks and signal completion before the instance is marked healthy and registered with the ALB. Additionally, deploying AWS Config with drift detection rules and automating remediation through EventBridge and Systems Manager Automation ensures that any manual alterations to resources are detected and corrected automatically without human intervention.

Step-by-Step Solution

1
Address the premature registration of instances by adding an EC2_INSTANCE_LAUNCHING lifecycle hook to the Auto Scaling group.
The instances will remain in the 'Pending:Wait' state rather than immediately moving to 'InService'.
This prevents the ALB target group from routing client traffic to the instance before it is fully configured.
2
Update the EC2 user data script to perform the configuration steps and then call the complete-lifecycle-action CLI command.
Upon successful completion of the bootstrap script, the instance transitions to 'InService' and begins serving traffic.
This guarantees that only fully bootstrapped and verified instances receive traffic.
3
Deploy the cloudformation-stack-drift-detection-check rule in AWS Config and configure a rule in Amazon EventBridge.
Configuration drift is monitored automatically, and EventBridge captures any non-compliant drift notifications.
AWS Config tracks whether resources managed by a stack have been manually altered.
4
Link the EventBridge rule to an AWS Systems Manager Automation runbook.
An automated workflow is triggered to revert manual alterations or run appropriate drift remediation steps.
This automates the continuous alignment of resources to their defined infrastructure-as-code baseline.

Key Concept

Continuous alignment of infrastructure states using automated drift remediation combined with safe scaling lifecycle boundaries.
Estimated Time:3m 0s
Rate this question

Topics

Automating Deployment and Configuration Management