Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

An enterprise application's infrastructure is deployed using an AWS CloudFormation stack. During a scheduled stack update, the process fails and subsequent rollback attempts fail, leaving the stack stuck in the UPDATE_ROLLBACK_FAILED state. A SysOps Administrator discovers that the rollback failed because an IAM role resource was modified out-of-band and the CloudFormation service role lacks sufficient permissions to revert the changes. Which of the following actions should the administrator take to successfully resolve the UPDATE_ROLLBACK_FAILED state and complete the rollback? (Select TWO.)

  1. Resolve the permission issue by attaching the required policies to the CloudFormation service role, then run the continue-update-rollback command.Answer
  2. Run the continue-update-rollback command and specify the logical ID of the IAM role in the resources-to-skip parameter to bypass rolling back that resource.Answer
  3. C
    Execute the update-stack command with the rollback-configuration parameter to force a rollback override of the failed resources.
  4. D
    Attach an inline policy to the administrator's IAM user identity containing the iam:AssumeRole action targeting the CloudFormation service role to manually perform the rollback.
  5. E
    Perform a stack delete operation with the retain-resources parameter to delete the stack and redeploy it from the original template.

Answer

To resolve a stack in the UPDATE_ROLLBACK_FAILED state, you can either correct the underlying issue (e.g., updating the CloudFormation service role permissions) and execute the continue-update-rollback command, or execute the continue-update-rollback command and specify the failing resources in the resources-to-skip parameter to bypass them during rollback.
To resolve a stack stuck in the UPDATE_ROLLBACK_FAILED state, you must either fix the root cause that blocked the rollback (such as updating IAM service role permissions or resolving external resource dependencies) and run the continue-update-rollback command, or run the continue-update-rollback command while specifying the logical IDs of the failing resources in the resources-to-skip parameter to bypass them and complete the rollback of the rest of the stack.

Step-by-Step Solution

1
Inspect the CloudFormation stack events to identify the resource that failed to roll back and the error message.
The event log reveals that the IAM role failed during rollback due to missing permissions in the CloudFormation service role.
To determine if the rollback block is remediable (like permissions) or if the resource must be skipped.
2
Resolve the permission issue by adding the necessary policy actions to the CloudFormation service role, or identify the logical ID of the IAM role to skip.
The service role is updated with the required permissions, or the logical ID of the IAM role is noted for skipping.
Preparing the state for retrying the rollback process.
3
Run the continue-update-rollback command (either with or without the resources-to-skip option depending on the chosen remediation strategy).
CloudFormation retries the rollback and successfully transitions the stack to a stable UPDATE_ROLLBACK_COMPLETE state.
This command triggers CloudFormation to resume and finish the failed rollback operation.

Key Concept

Resolving CloudFormation update rollback failures using the continue-update-rollback command and addressing underlying resource or permission issues.
Estimated Time:2m 0s
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic