Examkin

Question

Difficulty: MediumAWS CloudFormation Stack and Drift Management

An operations team uses an AWS CloudFormation stack to manage security infrastructure. During a stack update, a resource creation error occurs, triggering an automatic rollback. However, the rollback process fails, and the stack status changes to UPDATE_ROLLBACK_FAILED because an IAM role managed by the stack was previously deleted manually.

Which of the following actions should the SysOps Administrator perform to resolve this issue and return the stack to a stable state?

  1. Run the aws cloudformation continue-update-rollback command with the --resources-to-skip parameter set to the logical ID of the deleted IAM role.Answer
  2. B
    Run a drift detection scan on the stack to automatically synchronize its state and recreate the deleted IAM role.
  3. C
    Delete the entire CloudFormation stack and then redeploy it from scratch using the original template.
  4. D
    Assign a policy containing the iam:PassRole permission to the IAM user executing the stack update, then retry the update.

Answer

Run the aws cloudformation continue-update-rollback command with the --resources-to-skip parameter set to the logical ID of the deleted IAM role.
The correct action is to call the continue-update-rollback operation and skip the resource that caused the failure. When a stack is stuck in UPDATE_ROLLBACK_FAILED, CloudFormation allows you to resume the rollback while skipping specific resources (using the --resources-to-skip option in the CLI or through the console). This marks the skipped resources as rolled back and returns the stack to a stable UPDATE_ROLLBACK_COMPLETE state, allowing further updates or cleanups to be performed.

Step-by-Step Solution

1
Identify the resource that caused the rollback failure.
The stack events indicate that the rollback failed because the IAM role managed by the stack could not be found or updated.
Before continuing the rollback, you must identify which specific logical resource ID caused the UPDATE_ROLLBACK_FAILED state.
2
Execute the continue-update-rollback action and skip the failed resource.
Run the 'aws cloudformation continue-update-rollback' CLI command specifying the logical ID of the deleted IAM role in the '--resources-to-skip' parameter.
Skipping the failed resource allows CloudFormation to bypass the cleanup/rollback steps for that specific resource and successfully complete the rollback process for the rest of the stack.
3
Verify stack stability and perform manual remediation.
The stack status transitions to UPDATE_ROLLBACK_COMPLETE. You can then recreate the IAM role manually or update the template to align with the current state.
Since the resource was skipped, it is not present in AWS. Manual cleanup or synchronization is required to ensure drift is resolved and future updates can proceed.

Key Concept

Remediating CloudFormation stacks in the UPDATE_ROLLBACK_FAILED state by skipping resources during rollback.
Rate this question

Topics

AWS CloudFormation Stack and Drift Management

More questions from this topic