A developer is writing an AWS CloudFormation template to deploy a web application on an Amazon EC2 instance. The application requires a database password that needs automatic rotation, as well as several software packages. The developer wants to ensure that any updates to the software configuration in the template are automatically applied to the instance without replacing it.
Which two actions should the developer take to meet these requirements?
- Define the software configuration in the AWS::CloudFormation::Init resource metadata, run cfn-init in the UserData property to perform the initial installation, and configure the cfn-hup daemon to monitor changes.Cevap
- Use a dynamic reference in the CloudFormation template to retrieve the database password from AWS Secrets Manager.Cevap
- CStore the database password in Systems Manager Parameter Store and retrieve it via a dynamic reference, utilizing its native scheduled parameter rotation features.
- DInstall the packages by writing custom scripts in the EC2 UserData property, and instruct administrators to manually update the instance via SSH when template configurations change.
- EExecute the cfn-init script with the --rollback flag in UserData to monitor the stack status and roll back configuration files if a stack update enters the ROLLBACK_IN_PROGRESS state.
Cevap
Use the AWS::CloudFormation::Init resource metadata along with the cfn-init script and cfn-hup daemon to install and update software configurations, and use AWS Secrets Manager with dynamic references to securely store and automatically rotate the database password.
The correct options involve configuring the software installation using the CloudFormation metadata framework (AWS::CloudFormation::Init, cfn-init, and cfn-hup) to detect and apply updates automatically, and using AWS Secrets Manager to retrieve rotated database passwords dynamically.
Adım Adım Çözüm
Anahtar Kavram
AWS CloudFormation helper scripts and dynamic references for secret management.