Examkin

Question

Difficulty: HardAWS CloudFormation Stack and Drift Management

A SysOps Administrator runs drift detection on an AWS CloudFormation stack and finds that the policy of an Amazon S3 bucket managed by the stack has been manually modified, placing the stack in a DRIFTED state. The administrator wants to align the bucket's configuration with the stack template. The administrator attempts to resolve this by initiating a stack update using the original, unmodified template and parameters. Which of the following describes the result of this operation?

  1. The stack update will fail to execute and return a validation error indicating that no updates are to be performed, leaving the drift unresolved.Answer
  2. B
    The stack update will complete successfully and automatically overwrite the drifted bucket policy to match the definition in the template.
  3. C
    The stack update will run but fail during the update phase, triggering an automatic rollback that leaves the stack in the UPDATE_ROLLBACK_FAILED state.
  4. D
    The stack update will complete successfully, and CloudFormation will update the template's metadata to accept the drifted configuration as the new baseline.

Answer

The stack update will fail to execute and return a validation error indicating that no updates are to be performed, leaving the drift unresolved.
The correct answer is that the update will fail to execute with a validation error stating that no updates are to be performed. AWS CloudFormation evaluates stack updates based on changes to the template or parameters, not by comparing the template with the live state of the resources. When the template is identical, no update is triggered, leaving the drift in place.

Step-by-Step Solution

1
Analyze how AWS CloudFormation processes stack updates.
CloudFormation compares the new template and parameter set against the existing stack state in the service database.
To identify which resources need to be created, updated, or deleted.
2
Evaluate the behavior when the template and parameters are unmodified.
CloudFormation detects zero changes between the submitted template and the active stack template, throwing a validation error.
CloudFormation does not check live resource configurations for drift as part of the update comparison unless the template itself has changed.
3
Determine the final status of the drifted resource.
The manual changes remain on the S3 bucket policy, and the drift status of the stack remains DRIFTED.
Since no resource update is triggered, the drift is not remediated.

Key Concept

CloudFormation Drift Remediation and Update Behavior
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic