Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

A SysOps Administrator is updating an AWS CloudFormation stack. During the update process, a resource failure occurs and CloudFormation attempts to roll back the changes. However, the rollback fails, and the stack status changes to UPDATE_ROLLBACK_FAILED. The event logs indicate that the IAM service role originally used to create and manage the stack was deleted out-of-band.

What should the SysOps Administrator do to successfully complete the rollback and return the stack to a stable state?

  1. Run the aws cloudformation continue-update-rollback CLI command and specify a new, active IAM role ARN using the --role-arn parameter to perform the rollback operations.Answer
  2. B
    Modify the administrator's IAM user policy to grant the sts:AssumeRole permission on the deleted role, then execute aws cloudformation update-stack with a modified template.
  3. C
    Create a new CloudFormation template that removes the references to the deleted service role, then run the aws cloudformation update-stack command to force the rollback to bypass the missing role.
  4. D
    Delete the existing stack immediately to terminate active resources, perform a DNS failover to a new blue/green stack environment, and allow CloudFormation to clean up any remaining resources during deletion.

Answer

Run the continue-update-rollback command and specify a new, active IAM role ARN using the --role-arn parameter to perform the rollback operations.
Executing the continue-update-rollback command with a new, active IAM role ARN allows CloudFormation to bypass the deleted execution role and complete the rollback operations.

Step-by-Step Solution

1
Analyze the stack status and events to identify why the rollback failed.
The event log reveals that the IAM execution role associated with the stack has been deleted out-of-band, preventing CloudFormation from assuming it to revert resources.
To determine the appropriate recovery action, the administrator must find the root cause of the rollback blocker.
2
Identify the remediation path for a stack in the UPDATE_ROLLBACK_FAILED state.
A stack in this state cannot be updated or deleted normally; it must either complete the rollback via the continue-update-rollback action or have specific resources skipped.
CloudFormation requires the stack to return to a stable state before accepting new updates.
3
Execute the continue-update-rollback action while providing an active execution role.
Running the continue-update-rollback command with the --role-arn parameter provides a new, valid IAM role with permissions to finish rolling back the stack.
Providing a new role ARN overrides the deleted execution role, allowing CloudFormation to successfully perform the delete and update operations needed to finish the rollback.

Key Concept

AWS CloudFormation Update Rollback Failures Remediation
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic