Examkin

Soru

Zorluk: ZorAWS CloudFormation

A developer is managing a web application infrastructure deployed via an AWS CloudFormation stack. The stack includes an Amazon RDS DB instance and an Amazon ECS service. The developer needs to update the database master password to a new value and configure the ECS tasks to retrieve this password securely. During the update attempt, the stack update fails because another team member manually modified the database security group rules directly in the Amazon VPC console to debug a connection issue. Which combination of actions should the developer take to resolve the update failure and secure the password? (Select TWO.)

  1. Run drift detection on the CloudFormation stack, identify the differences in the database security group, and manually revert the security group rules in the VPC console to match the template definition before retrying the update.Cevap
  2. Update the CloudFormation template to reference the database password using the {{resolve:secretsmanager:db-password}} dynamic reference, allowing ECS tasks to retrieve the password securely at runtime.Cevap
  3. C
    Manually delete the modified database security group from the VPC console, and allow CloudFormation to automatically recreate the security group with the original configuration during the next stack update.
  4. D
    Save the database password as a plaintext string in a standard Systems Manager Parameter Store parameter and reference it using {{resolve:ssm:db-password}} to avoid the overhead of Secrets Manager.
  5. E
    Continue the stack update and select the option to ignore the database security group resource rollback, then run the UpdateStack API with the --force flag to override the drift status.

Cevap

Run drift detection on the CloudFormation stack to identify changes and manually revert the security group rules in the VPC console. Additionally, update the template to use the AWS Secrets Manager dynamic reference for the database password.
To fix a stack update blocked by out-of-band modifications, the developer must first identify the drift and manually revert the changes in the console to match the template. To secure the database password, the developer should use the AWS Secrets Manager dynamic reference, which securely resolves the secret during resource creation and runtime without exposing it in plaintext.

Adım Adım Çözüm

1
Initiate drift detection on the target CloudFormation stack.
The stack status reveals that the database security group has drifted from its template-defined state due to manual rules modifications.
Identifying the specific resources that have drifted is necessary to resolve conflicts before executing stack updates.
2
Manually revert the database security group rules in the VPC console back to the values specified in the CloudFormation template.
The security group configuration aligns perfectly with the template definition, and the drift status returns to IN_SYNC.
Resolving the drift state allows CloudFormation to execute updates without encountering resource state conflicts.
3
Modify the CloudFormation template to reference the database password from AWS Secrets Manager using the dynamic reference format.
The template uses the dynamic lookup expression to retrieve the credential securely at deployment and runtime.
This avoids hardcoding sensitive credentials in plaintext templates or parameters, meeting security compliance requirements.

Anahtar Kavram

Handling resource drift and managing secrets securely using dynamic references in AWS CloudFormation.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

AWS CloudFormation

Bu konudan daha fazla soru