Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

A SysOps Administrator is updating an AWS CloudFormation stack that contains an Amazon RDS DB instance. The stack update fails due to a configuration mismatch, prompting CloudFormation to initiate a rollback. During the rollback, the stack transitions to the UPDATE_ROLLBACK_FAILED state because an Amazon EC2 subnet group associated with the DB instance was manually deleted outside of CloudFormation. Which action must the SysOps Administrator take to return the stack to a stable, manageable state?

  1. Execute the ContinueUpdateRollback operation, specify the DB instance as a resource to skip, and then manually recreate the database configuration.Answer
  2. B
    Run the UpdateStack operation with a modified template that removes the DB instance resource from the stack definition.
  3. C
    Add the iam:PassRole permission to the administrator's policy for the CloudFormation service role to authorize the automatic recreation of the subnet group during rollback.
  4. D
    Run a drift detection operation on the stack, and then use the AWS CLI to trigger automatic remediation of the deleted subnet group.

Answer

Execute the ContinueUpdateRollback operation, specify the DB instance as a resource to skip, and then manually recreate the database configuration.
Executing the ContinueUpdateRollback operation and choosing to skip the DB instance allows CloudFormation to bypass the resource that is failing to rollback (due to the missing subnet group) and return the stack to a stable state (UPDATE_ROLLBACK_COMPLETE). Once the stack is stable, the administrator can manually recreate the deleted subnet group and synchronize the database configuration.

Step-by-Step Solution

1
Identify the resource causing the rollback failure and the reason for the failure from the CloudFormation stack events.
The DB instance resource is identified as the blocker because its associated subnet group has been deleted outside of CloudFormation.
Understanding the root cause of the UPDATE_ROLLBACK_FAILED state is necessary to determine which resource must be skipped or manually remediated.
2
Initiate the ContinueUpdateRollback operation via the AWS Management Console or AWS CLI.
Specify the DB instance as a resource to skip during the rollback continuation.
Skipping the resource bypasses the rollback check for the missing subnet group, allowing the rest of the stack to revert to a stable state.
3
Manually recreate the deleted subnet group and associate it with the DB instance to match the template configuration.
The physical infrastructure matches the CloudFormation template, resolving the resource drift.
Skipped resources must be manually reconciled to ensure the stack template and actual infrastructure are in sync for future updates.

Key Concept

Remediating a stack stuck in the UPDATE_ROLLBACK_FAILED state by using the ContinueUpdateRollback operation and skipping the failed resource.
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic