Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

A SysOps Administrator is updating an AWS CloudFormation stack that manages an Auto Scaling Group. The update introduces a new Launch Template that references a new IAM instance profile. The update fails during execution, and CloudFormation attempts to roll back. However, the stack transitions to the UPDATE_ROLLBACK_FAILED state. The administrator reviews the stack events and discovers that CloudFormation does not have permission to associate the previous IAM instance profile with the Auto Scaling Group. Which action should the SysOps Administrator take to resolve this issue and successfully complete the rollback of the stack?

  1. Update the CloudFormation service role to include the iam:PassRole permission for the previous IAM instance profile, and then perform the Continue Update Rollback operation on the stack.Answer
  2. B
    Manually delete the Auto Scaling Group and the new Launch Template from the AWS Management Console, and then perform the Rollback Stack operation on the stack.
  3. C
    Update the stack parameters directly to increase the rollback timeout, and then initiate an in-place deployment to redeploy the previous template configuration.
  4. D
    Modify the trust policy of the previous IAM role to allow cloudformation.amazonaws.com to assume the role, and then retry the stack update.

Answer

Update the CloudFormation service role to include the iam:PassRole permission for the previous IAM instance profile, and then perform the Continue Update Rollback operation on the stack.
The correct action is to add the iam:PassRole permission to the CloudFormation execution role to allow it to pass the previous IAM instance profile's role to the Auto Scaling launch template. Once this permission is in place, the administrator must run Continue Update Rollback to resume the rollback process.

Step-by-Step Solution

1
Analyze the stack status and events.
Identify that the stack is in the UPDATE_ROLLBACK_FAILED state due to missing permissions to configure the previous IAM instance profile.
CloudFormation requires authorization to pass existing or new IAM roles to AWS services during updates and rollbacks.
2
Modify the CloudFormation execution/service role policy.
Grant the iam:PassRole permission targeting the ARN of the previous IAM instance profile's role.
This enables CloudFormation to successfully associate the IAM role/profile with the Launch Template during rollback.
3
Invoke the Continue Update Rollback operation.
CloudFormation resumes and completes the rollback process, returning the stack to a stable UPDATE_ROLLBACK_COMPLETE state.
This is the required action to recover a stack from the UPDATE_ROLLBACK_FAILED state once the blocker is resolved.

Key Concept

Recovering from CloudFormation UPDATE_ROLLBACK_FAILED using Continue Update Rollback and configuring iam:PassRole permissions.
Estimated Time:1m 30s
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic