Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

A SysOps Administrator manages an AWS CloudFormation stack that contains an Amazon DynamoDB table. A developer manually deleted a global secondary index (GSI) from the DynamoDB table using the AWS Management Console to test an application performance issue. The SysOps Administrator runs drift detection on the stack, and the table is reported as DRIFTED. The administrator wants to restore the GSI to the DynamoDB table using AWS CloudFormation. Which action should the administrator take to achieve this?

  1. Update the CloudFormation template to remove the GSI definition, perform a stack update, and then perform another stack update using the original template containing the GSI definition.Answer
  2. B
    Perform a stack update using the original template containing the GSI definition without making any changes to the template or parameters.
  3. C
    Run the continue-update-rollback CLI command, specifying the DynamoDB table resource to force CloudFormation to sync with the template.
  4. D
    Initiate a stack update using the original template while specifying a new CloudFormation service role that lacks the iam:PassRole permission to trigger a validation rollback.

Answer

Update the CloudFormation template to remove the GSI definition, perform a stack update, and then perform another stack update using the original template containing the GSI definition.
The correct action is to update the template to match the drifted state (removing the GSI), execute a stack update to sync the stack metadata, and then perform a subsequent stack update using the original template containing the GSI. Because CloudFormation evaluates changes by comparing the submitted template against the last deployed template rather than the physical resource directly, this two-step update process is required to force CloudFormation to register the resource addition and provision the GSI.

Step-by-Step Solution

1
Modify the CloudFormation template by removing the DynamoDB global secondary index (GSI) configuration.
The template now matches the current physical state of the DynamoDB table where the GSI is missing.
This establishes a matching baseline between the template and the live resource so that CloudFormation registers them as aligned.
2
Perform a stack update using the modified template.
The stack completes the update successfully, updating its metadata to reflect that the table has no GSI, and clearing the drift status.
CloudFormation updates its internal state to reflect the removal without modifying the live database since the GSI was already manually deleted.
3
Perform another stack update using the original template that includes the GSI configuration.
CloudFormation detects the difference between the current stack state (no GSI) and the target template (with GSI), and provisions the GSI on the DynamoDB table.
This forces CloudFormation to physically create the GSI on the DynamoDB table, restoring the resource to the desired configuration.

Key Concept

CloudFormation drift remediation via stack updates requires establishing a baseline by matching the template to the drifted state before re-applying the desired configuration, as CloudFormation compares template versions rather than directly querying live resource states.
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic