Examkin

Question

Difficulty: Very hardDeployment Strategies and Execution

A SysOps administrator uses AWS CloudFormation to manage a production stack that includes an Amazon EC2 Auto Scaling group (ASG) behind an Application Load Balancer. The administrator attempts to update the application by modifying the CloudFormation template to use a new launch template. The new launch template specifies a new IAM instance profile with a new IAM role. The CloudFormation stack update is initiated using a dedicated IAM execution role.

During the deployment, the update fails on the ASG resource, causing CloudFormation to transition the stack to the UPDATE_ROLLBACK_IN_PROGRESS state. Shortly after, the stack status changes to UPDATE_ROLLBACK_FAILED. The CloudFormation event log shows an access denied error stating that CloudFormation is not authorized to associate the old IAM instance profile's role with the ASG's launch template.

How should the administrator resolve this issue to allow the rollback to complete successfully?

  1. A
    Modify the trust policy of the original IAM role to allow the autoscaling.amazonaws.com service principal to assume the role, and then initiate an UpdateStack API call with the previous template version.
  2. B
    Manually delete the resources that failed to roll back, update the administrator's IAM user policy to include sts:AssumeRole for the Auto Scaling service role, and then recreate the stack from the previous template.
  3. Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.Answer
  4. D
    Temporarily detach the Application Load Balancer from the Auto Scaling group to halt traffic, perform a manual in-place deployment of the previous application version to the instances, and then delete the failed CloudFormation stack.

Answer

Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.
The correct solution is to update the CloudFormation execution role's IAM policy to grant the iam:PassRole permission for the original role, and then run ContinueUpdateRollback. This is because CloudFormation needs explicit permission to pass the original role to the Auto Scaling group when rolling back the launch template. When a stack is in the UPDATE_ROLLBACK_FAILED state, the ContinueUpdateRollback action is the standard AWS mechanism to resume the rollback process after the block is resolved.

Step-by-Step Solution

1
Analyze the CloudFormation event log error details.
Identify that the failure is due to an Access Denied error when CloudFormation attempts to associate the previous launch template's IAM role with the Auto Scaling Group.
To determine the exact permission or resource constraint causing the rollback failure.
2
Identify the missing IAM permission required for the rollback.
Determine that the CloudFormation execution role requires the iam:PassRole permission for the original IAM role, because CloudFormation is passing that role back to the Auto Scaling Group.
When reverting a resource that uses an IAM role to its previous state, the execution entity must be authorized to pass the original role, not just the newly proposed role.
3
Update the IAM policy of the CloudFormation execution role.
Add the iam:PassRole permission for the Amazon Resource Name (ARN) of the original IAM role.
To authorize CloudFormation to perform the role assignment required for the rollback.
4
Execute the ContinueUpdateRollback command on the CloudFormation stack.
CloudFormation resumes the rollback process, successfully configures the ASG back to the previous launch template, and transitions the stack to UPDATE_ROLLBACK_COMPLETE.
A stack in the UPDATE_ROLLBACK_FAILED state must be explicitly instructed to resume rolling back using the ContinueUpdateRollback operation once the blocking issue is resolved.

Key Concept

Troubleshooting CloudFormation stack updates and rollbacks involving IAM PassRole permissions
Rate this question

Topics

Deployment Strategies and Execution

More questions from this topic