Examkin

Soru

Zorluk: OrtaAWS CloudFormation

A developer uses AWS CloudFormation to manage an application's infrastructure. An administrator manually modified the inbound rules of a security group associated with an Amazon EC2 instance using the AWS Management Console to resolve a temporary connection issue. The developer runs a drift detection status check on the stack, and the security group is flagged as DRIFTED. Which action should the developer take to resolve the drift and ensure the resource configuration is correctly aligned with the CloudFormation template?

  1. Revert the manual changes in the security group directly via the Amazon EC2 console to match the template, or update the template to include the modified rules and run a stack update.Cevap
  2. B
    Execute the aws cloudformation update-stack command with the --resolve-drift parameter to automatically sync the live configuration back to the template's specification.
  3. C
    Delete the drifted security group resource from the AWS Management Console, and trigger a stack update with rollback disabled to force CloudFormation to recreate it.
  4. D
    Create a new AWS Secrets Manager secret containing the updated security group rules, and reference the secret using a dynamic reference in the CloudFormation template.

Cevap

Revert the manual changes in the security group directly via the Amazon EC2 console to match the template, or update the template to include the modified rules and run a stack update.
To resolve drift on a resource managed by CloudFormation, you must either revert the manual out-of-band changes directly in the resource's service console (or via CLI) so it matches the template configuration, or update the CloudFormation template to match the drifted state and perform a stack update to sync the stack status.

Adım Adım Çözüm

1
Identify the drifted properties of the resource using the drift detection details in the AWS CloudFormation console.
The differences between the expected template configuration and the actual live configuration of the security group are revealed.
This allows the developer to pinpoint exactly which rules were modified, added, or deleted out-of-band.
2
Decide whether to keep the manual changes or revert them.
A plan is made to either rollback the manual console edits or update the template to adopt them permanently.
Resolving drift requires aligning the expected template definition with the physical resource state.
3
Perform the alignment action by either manually updating the security group rules in the EC2 Console to match the template, or updating the CloudFormation template to match the new rules followed by a stack update.
The resource configuration matches the template, and subsequent drift detection checks will report the resource as IN_SYNC.
This establishes a clean baseline for future CloudFormation deployments and prevents deployment failures.

Anahtar Kavram

CloudFormation Drift Detection and Resolution
Bu soruyu puanla

Konular

AWS CloudFormation

Bu konudan daha fazla soru