A SysOps Administrator uses AWS CloudFormation to manage a production infrastructure stack. The deployment is executed using a dedicated CloudFormation service role. The Administrator initiates a stack update to deploy a new version of an Amazon ECS service, which references a newly created ECS Task Execution IAM Role. During the deployment, the stack update fails because the service cannot start the new tasks, and CloudFormation transitions to UPDATE_ROLLBACK_IN_PROGRESS. However, the rollback operation also fails, and the stack ends up in the UPDATE_ROLLBACK_FAILED state. Upon reviewing the CloudFormation events, the Administrator discovers that the rollback failed because CloudFormation was unauthorized to associate the original ECS Task Execution Role back to the ECS service. Which of the following is the root cause of this failure, and how should it be resolved?
- The CloudFormation service role lacks the iam:PassRole permission for the original ECS Task Execution Role. To resolve this, attach an IAM policy granting the iam:PassRole permission for the original role to the CloudFormation service role, and then select the Continue update rollback action in the CloudFormation console.Answer
- BThe Administrator's IAM user policy lacks the iam:PassRole permission for the original ECS Task Execution Role. To resolve this, add the iam:PassRole permission for the original role to the Administrator's IAM user, and then initiate a new stack update targeting the previous template.
- CThe ECS cluster does not have sufficient capacity to run the original task definition. To resolve this, manually scale up the ECS cluster's container instances, and then click Update Stack to force a redeployment of the original template.
- DThe CloudFormation service role lacks the sts:AssumeRole trust relationship with the ECS service principal. To resolve this, edit the trust policy of the CloudFormation service role to allow ecs-tasks.amazonaws.com to assume it, and then delete the failed stack to redeploy it from scratch.