Examkin

Question

Difficulty: Very hardAWS CloudFormation Stack and Drift Management

A SysOps Administrator is updating an AWS CloudFormation stack that manages an Auto Scaling group and an associated IAM role. The update fails, triggering an automatic rollback. During the rollback, the stack enters the UPDATE_ROLLBACK_FAILED state. The stack events show that the custom CloudFormation service role is missing the iam:PassRole permission required to associate the IAM instance profile with the Auto Scaling group's Launch Template.

Which two actions can the Administrator take to successfully complete the rollback and return the stack to a stable state? (Select TWO.)

  1. Modify the policy attached to the current custom CloudFormation service role to grant the iam:PassRole permission for the instance profile's IAM role, and then invoke the Continue Update Rollback operation.Answer
  2. Invoke the Continue Update Rollback operation and specify the ARN of a different IAM service role that already has the required iam:PassRole permission.Answer
  3. C
    Modify the Administrator's personal IAM policy to grant the iam:PassRole permission for the CloudFormation service role, and then execute the Update Stack operation.
  4. D
    Run the Update Stack operation using the --rollback-configuration parameter and specify the previous working template version.
  5. E
    Delete the stack using the CloudFormation console, select the option to retain the Auto Scaling group, and then redeploy the stack using the original template.

Answer

Modify the policy attached to the current custom CloudFormation service role to grant the iam:PassRole permission for the instance profile's IAM role, and then invoke the Continue Update Rollback operation. Alternatively, invoke the Continue Update Rollback operation and specify the ARN of a different IAM service role that already has the required iam:PassRole permission.
The correct options involve resolving the permissions gap and completing the rollback using the Continue Update Rollback API. A SysOps Administrator can either update the current service role's policy to add the required `iam:PassRole` permissions, or specify a different service role (using the `--role-arn` parameter) that has the correct permissions. Both methods allow the CloudFormation service to successfully execute the rollback operations and return the stack to a stable state.

Step-by-Step Solution

1
Analyze the stack status and events to determine the cause of the failure.
Identify that the stack is in the UPDATE_ROLLBACK_FAILED state due to the custom service role missing the iam:PassRole permission.
Before performing remediation, the administrator must inspect the CloudFormation events to pinpoint the exact resource and permission that caused the rollback to fail.
2
Select a recovery approach: either update the existing role or use a different role.
Decide to either attach a policy containing the iam:PassRole action to the existing role, or identify an alternative role that already has this policy.
Since CloudFormation requires the service role to have permissions to make changes to target resources and pass required roles, the permission gap must be bridged before the rollback can resume.
3
Execute the Continue Update Rollback operation.
Trigger Continue Update Rollback, optionally passing the ARN of the new service role if the second approach is selected.
Stacks in the UPDATE_ROLLBACK_FAILED state can only be returned to a stable state (such as UPDATE_ROLLBACK_COMPLETE) by completing the rollback process via the Continue Update Rollback command.

Key Concept

CloudFormation Stack Recovery and Service Role Permissions
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic