Examkin

Question

Difficulty: Very hardAWS CloudFormation Stack and Drift Management

An operations team uses an AWS CloudFormation stack to manage a multi-tier application. The stack was created using a custom IAM service role to restrict CloudFormation's execution permissions. During a recent stack update, a resource modification failed, initiating an automatic rollback. During the rollback process, the stack transitioned to the UPDATE_ROLLBACK_FAILED state because the custom IAM service role had its permissions modified during the update, removing the authorization to delete EC2 security groups. Which sequence of steps should a SysOps administrator perform to successfully complete the rollback to a stable state while minimizing privileges?

  1. A
    Execute the aws cloudformation continue-update-rollback command specifying the Amazon Resource Name (ARN) of a new IAM role with the correct permissions, relying on the new role's trust policy allowing the sts:AssumeRole action for the administrator's identity.
  2. B
    Manually delete the blocking EC2 security group from the Amazon VPC console, and then run the aws cloudformation update-stack command using the previous successful template version to restore stack consistency.
  3. Grant the administrator iam:PassRole permissions for a new IAM role that possesses the necessary permissions to delete security groups, then execute the aws cloudformation continue-update-rollback command specifying this new role's Amazon Resource Name (ARN).Answer
  4. D
    Delete the failed CloudFormation stack to clean up the existing resources, adjust the permissions of the custom IAM service role, and then redeploy the application stack using the original template.

Answer

Grant the administrator iam:PassRole permissions for a new, correctly configured IAM role, and then run the continue-update-rollback command specifying that role's ARN.
To recover a CloudFormation stack from the UPDATE_ROLLBACK_FAILED state, the administrator must trigger the continue-update-rollback workflow. Since the original IAM service role lost the necessary permissions to delete the security group, the administrator can specify a new, properly permissioned role. To pass this new role to CloudFormation, the administrator's identity must possess the iam:PassRole permission. This allows the rollback to proceed securely under the new role's authority without granting excessive permissions to the administrator's account or tearing down the stack.

Step-by-Step Solution

1
Identify the cause of the rollback failure by inspecting the CloudFormation stack events, which indicates that the associated IAM service role lacks permissions to delete the EC2 security group.
The root cause is confirmed as a permissions issue on the current execution role.
Understanding why the rollback is blocked is necessary before attempting remediation.
2
Create a new IAM role containing permissions to perform the required clean-up action (deleting the security group) and configure its trust policy to allow CloudFormation to assume it.
A new target IAM role is available for the stack operation.
A role with the proper permissions is needed to execute the cleanup tasks during rollback.
3
Attach an IAM policy to the administrator's identity that grants the iam:PassRole permission for the newly created IAM role.
The administrator is authorized to delegate the new role to CloudFormation.
CloudFormation requires the user initiating the command to have PassRole permissions to prevent unauthorized privilege escalation.
4
Run the continue-update-rollback CLI command, specifying the stack name and the ARN of the new IAM role.
CloudFormation resumes the rollback process using the new role and successfully completes the rollback.
The continue-update-rollback action bypasses the update failure block and processes the rollback to return the stack to a stable state.

Key Concept

Recovering a CloudFormation stack from UPDATE_ROLLBACK_FAILED by using a new service role and the continue-update-rollback API.
Estimated Time:3m 0s
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic