Examkin

Question

Difficulty: EasyAWS CloudFormation Stack and Drift Management

An AWS CloudFormation stack update fails, and the stack becomes stuck in the `UPDATE_ROLLBACK_FAILED` state because a Security Group resource cannot be deleted. Which of the following actions can a SysOps Administrator take to successfully complete the rollback of the stack? (Select TWO.)

  1. Manually resolve the dependency that prevents the Security Group from being deleted, then choose Continue update rollback in the AWS CloudFormation console.Answer
  2. Run the `continue-update-rollback` command using the AWS CLI and specify the logical ID of the Security Group in the resources to skip parameter.Answer
  3. C
    Change the stack policy to allow all updates, then use the `aws cloudformation rollback-stack` command to force the rollback to complete.
  4. D
    Delete the stack template from the local workspace and deploy it as a new nested stack using the `aws cloudformation deploy` command.
  5. E
    Modify the stack's service role to grant the `iam:PassRole` permission to the Security Group, then run drift detection on the stack.

Answer

To resolve the failed rollback, the administrator must either manually remove the dependency that blocks the Security Group from being deleted and then continue the rollback, or execute the continue-update-rollback action and specify the Security Group to be skipped.
The correct options describe the two supported methods for resolving a stack rollback failure in AWS CloudFormation. The administrator can manually resolve the dependency blocking the resource deletion (such as detaching the Security Group from an EC2 instance launched outside the stack) and then select the 'Continue update rollback' option. Alternatively, the administrator can bypass the blocker by using the AWS CLI `continue-update-rollback` command with the `--resources-to-skip` parameter to omit the blocked Security Group.

Step-by-Step Solution

1
Inspect the CloudFormation stack events to find the resource causing the rollback failure.
Identify that the Security Group cannot be deleted, placing the stack in the UPDATE_ROLLBACK_FAILED state.
This determines which specific resource is blocking the stack rollback operation.
2
Choose whether to fix the dependency manually (e.g., disassociating the Security Group from any active network interfaces) or skip the resource during the rollback.
Decide on a path to either satisfy the deletion constraint or bypass it.
CloudFormation requires either the underlying issue to be resolved or explicit permission to skip the failed resource.
3
Trigger the 'Continue update rollback' process via the AWS Console or the AWS CLI.
The stack completes the rollback and returns to a stable UPDATE_ROLLBACK_COMPLETE or ROLLBACK_COMPLETE state.
This resumes the rollback operation and brings the stack back to a manageable state.

Key Concept

When an AWS CloudFormation stack enters the UPDATE_ROLLBACK_FAILED state, it cannot be updated or modified until the rollback is resolved. This state is resolved by using the Continue Update Rollback action, either after fixing the blocking dependency manually or by skipping the blocked resources.
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic