Examkin

Question

Difficulty: HardAWS CloudFormation Stack and Drift Management

A SysOps Administrator is managing a production web application deployed via an AWS CloudFormation stack. The stack contains an Auto Scaling group, an Amazon RDS DB instance, and a Security Group. A recent drift detection operation indicates that the stack is in the DRIFTED state. The Security Group was manually modified to allow traffic on port 8080 from an unauthorized IP range, and the RDS DB instance type was manually upgraded to support higher traffic. The administrator wants to safely remediate the drift so that the resources and the CloudFormation stack are synchronized.

Which combination of actions will achieve this goal? (Select TWO.)

  1. Manually revert the Security Group rules via the Amazon VPC console or AWS CLI to match the configurations defined in the CloudFormation template.Answer
  2. Update the CloudFormation template to reflect the upgraded RDS DB instance type, and then perform a stack update using the updated template.Answer
  3. C
    Execute the 'aws cloudformation detect-stack-drift' command with the '--remediate-drift' parameter to force the drifted physical resources to revert to the template's state.
  4. D
    Delete the drifted RDS DB instance and the Security Group from the stack, and then run 'aws cloudformation continue-update-rollback' to force a clean deployment.
  5. E
    Grant the 'iam:PassRole' permission to the CloudFormation execution role to allow CloudFormation to automatically overwrite the out-of-band changes on the next drift detection scan.

Answer

Remediate the drift by manually reverting the Security Group rules to match the template, and updating the template to match the upgraded RDS DB instance type before performing a stack update.
Remediating drift in AWS CloudFormation requires bringing the resource configurations and the template back into alignment. This can be achieved by either manually reverting the resource's configuration in the console or CLI to match the template, or by updating the template to match the resource's current configuration and executing a stack update.

Step-by-Step Solution

1
Analyze the drift detection output to identify which properties of the Security Group and RDS DB instance have drifted from the template.
Identify that the Security Group has unauthorized port rules, and the RDS DB instance has an upgraded instance type.
Understanding the exact changes helps determine if they should be reverted or integrated into the template.
2
Revert the unauthorized Security Group configuration changes manually via the VPC Console or CLI.
The Security Group matches the template configuration, reverting the drift.
Manual out-of-band changes that violate security requirements must be reverted to restore compliance.
3
Update the CloudFormation template to match the desired upgraded RDS DB instance type and perform a stack update.
The template definition matches the actual physical resource property, and the stack status for the RDS resource becomes IN_SYNC.
Integrating desired manual changes into the template ensures they are preserved in future deployments.

Key Concept

CloudFormation Drift Remediation Options
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic