Examkin

Question

Difficulty: HardAWS CloudFormation Stack and Drift Management

A SysOps Administrator is managing a CloudFormation stack that deploys a database application, using a dedicated AWS Identity and Access Management (IAM) service role for stack operations. The administrator attempts to update the stack to replace an Amazon RDS DB instance with a new configuration. The update fails during the deployment of a dependent resource, triggering a rollback. However, the rollback fails, and the stack status changes to UPDATE_ROLLBACK_FAILED. AWS CloudTrail logs reveal that the service role was unable to perform the deletion of the old RDS DB instance due to an AccessDenied error. What should the administrator do to resolve the rollback failure and return the stack to a stable state?

  1. A
    Delete the old RDS DB instance manually using the Amazon RDS console, and then run the rollback-stack command targeting the stack.
  2. Update the IAM policy attached to the CloudFormation service role to grant the rds:DeleteDBInstance permission, and then run the continue-update-rollback command.Answer
  3. C
    Attach an IAM policy with iam:PassRole permissions to the administrator's IAM identity, and then run the update-stack command with the --role-arn parameter pointing to the service role.
  4. D
    Run the update-stack command with the --rollback-configuration parameter set to disable rollback for the RDS DB instance resource.

Answer

Update the IAM policy attached to the CloudFormation service role to grant the rds:DeleteDBInstance permission, and then run the continue-update-rollback command.
The correct action is to update the IAM policy of the service role with the missing rds:DeleteDBInstance permission and run the continue-update-rollback command. This allows AWS CloudFormation to resume the rollback process using the updated permissions of the service role and return the stack to a stable state.

Step-by-Step Solution

1
Analyze the rollback failure reason.
Identify from CloudTrail and CloudFormation stack events that the rollback failed due to an AccessDenied error when the service role attempted to delete the old RDS DB instance.
Diagnosing the root cause of the rollback failure is necessary to determine the appropriate remediation action.
2
Update the service role permissions.
Add the rds:DeleteDBInstance action to the IAM policy attached to the CloudFormation service role.
The service role must have sufficient permissions to delete the resources being replaced or cleaned up during a rollback operation.
3
Resume the update rollback.
Execute the continue-update-rollback command (or select Continue update rollback in the console).
This command prompts CloudFormation to retry the rollback process, which will now succeed due to the updated service role permissions.

Key Concept

AWS CloudFormation Update Rollback Failure Resolution
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic