Examkin

Question

Difficulty: HardAWS CloudFormation Stack and Drift Management

An AWS CloudFormation stack update fails during execution, causing CloudFormation to initiate a rollback. However, the rollback process also fails, and the stack status changes to UPDATE_ROLLBACK_FAILED. The stack was configured to use a dedicated IAM service role named CloudFormationExecutionRole for all provisioning actions. Which actions should a SysOps Administrator perform to successfully return this stack to a stable, manageable state? (Select TWO.)

  1. Continue the stack rollback from the AWS CloudFormation console or AWS CLI, specifying the failed resources to be skipped.Answer
  2. Identify the missing permissions in the CloudFormationExecutionRole, attach an updated IAM policy containing those permissions, and continue the rollback.Answer
  3. C
    Perform a drift detection operation on the stack to identify the manual changes, then export the drift status to automatically sync the template.
  4. D
    Edit the stack template to add a DeletionPolicy of Retain for the failing resources, then perform a stack update to force a clean state.
  5. E
    Modify the trust policy of CloudFormationExecutionRole to include iam:AssumeRole on itself to bypass the permission checks during rollback.

Answer

To resolve the rollback failure, the administrator should either continue the stack rollback while skipping the failed resources or update the execution role with the missing permissions and continue the rollback.
Continuing the rollback and skipping the failed resources allows CloudFormation to proceed with rolling back the rest of the stack, resolving the failed state. Alternatively, updating the execution role policy with the required permissions allows the rollback to successfully execute on the failing resource when continued.

Step-by-Step Solution

1
Analyze the stack events to identify the specific resource that caused the rollback failure and the associated error message.
The failure reason, such as missing permissions or modified resource states, is identified.
This determines whether permissions need to be adjusted or if resources must be skipped.
2
If the issue is missing permissions, update the CloudFormation execution role's IAM policy. Otherwise, prepare to skip the failed resources.
The execution environment is corrected or a skipping strategy is prepared.
Ensures that the next rollback attempt does not fail on the same resource.
3
Execute the Continue Update Rollback command via the console or CLI, optionally specifying the resources to skip.
The rollback resumes and completes, transitioning the stack to the UPDATE_ROLLBACK_COMPLETE state.
This returns the stack to a stable state where it can be updated or deleted normally.

Key Concept

AWS CloudFormation Update Rollback Failures and Remediation
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic