Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

A SysOps Administrator is managing an AWS CloudFormation stack that contains an Amazon RDS DB instance and an IAM role. A drift detection operation on the stack reports that both resources are in a DRIFTED status because of manual modifications. The Administrator needs to bring the stack and the physical resources back into alignment. Which of the following actions should the Administrator take to remediate this resource drift? (Select TWO.)

  1. Manually modify the RDS DB instance and the IAM role outside of CloudFormation to match the expected configurations defined in the stack template.Answer
  2. Update the CloudFormation template or parameters to match the current manual configurations of the resources, and then perform a stack update.Answer
  3. C
    Run the `aws cloudformation resolve-stack-drift` AWS CLI command to force the resources to synchronize with the stack template.
  4. D
    Update the stack using a service role that has `iam:PassRole` permissions to allow CloudFormation to automatically overwrite the manual changes to the IAM role.
  5. E
    Initiate a stack update using the original template, and enable the option to automatically recreate drifted resources during the update.

Answer

Remediate the drift by either manually modifying the RDS DB instance and the IAM role outside of CloudFormation to match the template, or by updating the CloudFormation template to match the drifted resources and running a stack update.
To remediate resource drift in AWS CloudFormation, you can either manually modify the resources directly in their respective services to align with the template's expected configurations, or you can update the template and parameters to reflect the drifted configurations and perform a stack update. Modifying the resources manually resets them to the state defined in the template, while updating the template accepts the changes as the new source of truth.

Step-by-Step Solution

1
Detect drift on the stack.
Identify that the RDS DB instance and the IAM role have configurations that differ from the template.
This establishes which resource properties have changed from their expected template definitions.
2
Choose remediation path: either align resources with the template, or align the template with the resources.
Decide whether to revert manual changes on the physical resources or update the template to accept the manual modifications.
CloudFormation does not auto-sync drift; the administrator must perform these manual reconciliation actions.
3
Perform stack update or manual configuration changes.
The stack status returns to IN_SYNC.
Completing the chosen path resolves the configuration discrepancy.

Key Concept

CloudFormation drift detection identifies manual changes made to stack resources outside of CloudFormation. Remediation requires either manually reverting the changes on the resource or updating the template to reflect the current state and updating the stack.
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic