Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

An organization uses an AWS CloudFormation stack to manage its network infrastructure. A SysOps Administrator runs drift detection on the stack and identifies that a security group has a status of MODIFIED because a developer manually added an inbound rule allowing TCP port 3389. The administrator wants to resolve this drift so that the security group's actual configuration matches the expected configuration defined in the CloudFormation template.

Which action should the administrator take to remediate the drift?

  1. Manually delete the inbound rule allowing TCP port 3389 from the security group using the Amazon EC2 console or the AWS CLI.Answer
  2. B
    Select the drifted security group in the AWS CloudFormation console and execute the automatic drift remediation action.
  3. C
    Perform a stack update using the original template and enable the Force Redeploy option to overwrite the drift.
  4. D
    Run the aws cloudformation sync-stack-drift CLI command to automatically import the drifted state into the template.

Answer

Manually delete the inbound rule allowing TCP port 3389 from the security group using the Amazon EC2 console or the AWS CLI.
To resolve drift and align the resource back to the template's expected state, the out-of-band changes must be manually reverted (e.g., deleting the manually added security group rule). CloudFormation does not provide an automated tool to revert drifted configurations back to their template-defined state.

Step-by-Step Solution

1
Identify the drifted resource and the specific parameters that are drifted from the template.
The security group is identified as MODIFIED due to the manual addition of the inbound rule for TCP port 3389.
Understanding the exact nature of the drift is necessary to determine the required remediation steps.
2
Determine the target state for the resource (in this case, returning it to the template's expected state).
The target state is the configuration defined in the original template, which does not include the TCP port 3389 inbound rule.
Remediating drift to match the template requires removing out-of-band changes.
3
Manually remove the out-of-band configuration directly on the resource.
The inbound rule for TCP port 3389 is deleted from the security group via the EC2 console or CLI, resolving the drift.
CloudFormation does not automate the rollback of drifted resources, requiring manual intervention to sync back to the template.

Key Concept

AWS CloudFormation Drift Remediation
Estimated Time:1m 30s
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic