Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

A SysOps Administrator is managing an infrastructure stack deployed via AWS CloudFormation. The stack contains an Amazon S3 bucket, an Amazon EC2 instance, and an IAM role, and is configured to use a specific IAM service role for stack operations. During a recent update, the deployment failed and the stack is now in the UPDATE_ROLLBACK_FAILED state. Which TWO actions should the administrator take to troubleshoot and successfully complete the rollback? (Select TWO.)

  1. Verify that the CloudFormation service role has the required permissions to modify or delete the resources that failed during the rollback process.Answer
  2. Execute the Continue Update Rollback operation and choose to skip the specific resources that are preventing the rollback from succeeding.Answer
  3. C
    Run a drift detection scan on the stack to automatically apply the template's configuration back to the out-of-sync physical resources.
  4. D
    Update the Administrator's IAM user policy to grant the sts:AssumeRole permission on the CloudFormation service role to authorize the rollback execution.
  5. E
    Change the stack's DisableRollback parameter to true to force CloudFormation to ignore the failures and mark the stack update as complete.

Answer

Verify that the CloudFormation service role has the required permissions to modify or delete the resources that failed, and execute the Continue Update Rollback operation to skip the specific resources preventing the rollback from succeeding.
To resolve a stack in the UPDATE_ROLLBACK_FAILED state, the administrator must either fix the root cause of the rollback failure or bypass the failing resources. Verifying that the CloudFormation service role has the correct permissions addresses authorization failures. If a resource cannot be rolled back because it was deleted or modified out-of-band, the administrator must run the Continue Update Rollback operation and choose to skip the failing resources, allowing the rest of the stack to reach a stable state.

Step-by-Step Solution

1
Review the stack's events in the AWS CloudFormation console or via the AWS CLI.
Identify the specific resources that failed during the rollback process and the exact error messages.
This pinpoints whether the failure is due to missing permissions (Access Denied) or missing physical resources (Not Found).
2
Inspect the policy attached to the CloudFormation service role assigned to the stack.
Verify that the role contains permissions to delete or modify the failed resources.
If permissions are missing, updating the role allows CloudFormation to proceed with the rollback.
3
Perform a Continue Update Rollback operation and list the drifted/deleted resources to be skipped.
CloudFormation skips the specified resources, rolls back the rest of the stack, and sets the status to UPDATE_ROLLBACK_COMPLETE.
This bypasses the blocking resources to return the stack to a stable state so manual cleanup can occur.

Key Concept

AWS CloudFormation Update Rollback Failure Remediation
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic