Examkin

Question

Difficulty: Very hardAWS CloudFormation Stack and Drift Management

An organization uses an AWS CloudFormation stack to deploy an Application Load Balancer, an Auto Scaling group, and associated security groups. A stack update fails due to a configuration error in the Auto Scaling group launch template. During the subsequent automatic rollback, a security group that was manually modified outside of CloudFormation prevents the rollback from completing, leaving the stack in the UPDATE_ROLLBACK_FAILED state. Which actions must a SysOps Administrator perform to successfully recover the stack to a stable state and ensure the template and physical resources are aligned? (Select TWO.)

  1. Perform a Continue Update Rollback operation, specifying the blocked security group as a resource to skip during the rollback.Answer
  2. After the rollback completes, manually update the skipped security group to match its expected configuration in the CloudFormation template.Answer
  3. C
    Use the drift detection feature to identify the differences in the security group, then use the drift remediation tool to automatically synchronize the manual modifications back into the stack template.
  4. D
    Delete the stack while enabling the Retain Resources option for the entire stack, then import the existing resources into a new stack template.
  5. E
    Create a new IAM service role with iam:PassRole permissions, associate it with the stack, and immediately run the Update Stack command to overwrite the failed rollback status.

Answer

To recover the stack and align it with the template, perform a Continue Update Rollback operation while skipping the blocked security group. Once the rollback completes, manually update the skipped security group to match its expected configuration in the template.
Continuing the update rollback and specifying the blocked security group to be skipped allows the stack to successfully roll back and reach the stable UPDATE_ROLLBACK_COMPLETE state. After the rollback completes, the skipped resource must be manually updated to match its expected template definition because skipping it leaves it in an inconsistent state relative to the template.

Step-by-Step Solution

1
Initiate Continue Update Rollback
Bypasses the block on the security group by selecting it as a resource to skip during rollback.
Allows CloudFormation to return the other resources to their pre-update state and transition the stack out of the failed rollback status.
2
Verify Stack Status
The stack transitions to UPDATE_ROLLBACK_COMPLETE.
Confirms the stack is in a stable state where update operations are permitted again.
3
Manually Reconcile Skipped Resource
The physical security group configuration is manually updated to match the CloudFormation template.
Ensures the resources match the template configuration, resolving the drift introduced by skipping the resource during rollback.

Key Concept

Recovering from CloudFormation UPDATE_ROLLBACK_FAILED state by skipping blocked resources and manually reconciling drift.
Estimated Time:3m 0s
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic