Examkin

Question

Difficulty: HardAWS CloudFormation Stack and Drift Management

A SysOps Administrator is updating an AWS CloudFormation stack that manages an Auto Scaling group and an Amazon RDS DB instance. The update fails during the database configuration step, triggering a rollback. The rollback also fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. The stack events show that the IAM service role assigned to the CloudFormation stack lacks the rds:DeleteDBInstance permission required to remove the failed RDS resource. Which combination of actions must the SysOps Administrator perform to resolve this issue and return the stack to a stable state? (Select TWO.)

  1. Modify the IAM service role associated with the CloudFormation stack to include the missing RDS permissions.Answer
  2. Run the aws cloudformation continue-update-rollback command to resume the rollback process.Answer
  3. C
    Run the aws cloudformation rollback-stack command to force the rollback to completion.
  4. D
    Manually delete the failed RDS DB instance via the Amazon RDS console, then run the aws cloudformation update-stack command.
  5. E
    Perform a stack drift remediation by updating the local template and applying a new change set to force an override of the resource state.

Answer

To resolve the rollback failure and return the stack to a stable state, the SysOps Administrator must update the associated IAM service role to grant the missing rds:DeleteDBInstance permission and then execute the continue-update-rollback CLI command to resume the rollback process.
To resolve the UPDATE_ROLLBACK_FAILED state, you must address the root cause (the missing IAM permissions) and then explicitly instruct CloudFormation to resume rolling back the remaining resources. Thus, modifying the associated IAM service role to grant the missing permissions and running continue-update-rollback are the correct steps.

Step-by-Step Solution

1
Analyze stack events to identify the resource and missing permission causing the rollback failure.
Identified that the rollback failed on the RDS DB instance due to the IAM service role lacking rds:DeleteDBInstance permissions.
Before continuing rollback, you must identify why it failed to address the root cause.
2
Update the IAM service role associated with the CloudFormation stack to attach a policy containing the missing rds:DeleteDBInstance permission.
The IAM service role now has sufficient permissions to delete the database resource.
CloudFormation performs actions using this role, so it must have the permissions necessary to delete resources created during the failed update.
3
Execute the aws cloudformation continue-update-rollback command from the CLI.
CloudFormation retries the rollback, successfully deletes the failed database instance using the updated role permissions, and returns the stack to the ROLLBACK_COMPLETE state.
This command is the only valid way to resume and complete a failed update rollback process in CloudFormation.

Key Concept

Resolving CloudFormation update rollback failures by fixing IAM execution role permissions and using the continue-update-rollback action.
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic