Examkin

Soru

Zorluk: OrtaAWS CloudFormation

A developer is using AWS CloudFormation to deploy a web application. The template requires a database password that must be retrieved securely without being hardcoded or exposed in plaintext. During the deployment testing phase, the developer also needs to ensure that if any resource fails to create or update, the stack does not automatically revert its changes, allowing the developer to investigate the failed resource state.

Which two actions should the developer take to meet these requirements? (Select TWO.)

  1. Reference the database password in the template using the dynamic reference pattern for AWS Secrets Manager.Cevap
  2. Specify the --disable-rollback parameter when executing the create-stack or update-stack command via the AWS CLI.Cevap
  3. C
    Reference the database password in the template using the dynamic reference pattern for a Systems Manager Parameter Store parameter of type String.
  4. D
    Manually delete the failed resource via the AWS Management Console and run drift detection to trigger CloudFormation to automatically recreate the resource.
  5. E
    Store the database password in Systems Manager Parameter Store using a standard String parameter type to optimize cost, and import it as a template parameter.

Cevap

Reference the database password using the AWS Secrets Manager dynamic reference pattern, and specify the --disable-rollback parameter when executing the create-stack or update-stack command via the AWS CLI.
The correct options are referencing the database password using the dynamic reference pattern for AWS Secrets Manager and specifying the --disable-rollback parameter when executing the create-stack or update-stack command. AWS Secrets Manager dynamic references securely fetch credentials at deployment time without exposing them. The --disable-rollback parameter prevents the stack from automatically reverting on failure, preserving the resource state for troubleshooting.

Adım Adım Çözüm

1
Secure the database password by storing it in AWS Secrets Manager.
The password is encrypted and managed centrally, avoiding hardcoding.
AWS Secrets Manager is designed for storing sensitive secrets and credentials.
2
Update the CloudFormation template to reference the secret using the dynamic reference syntax: resolve:secretsmanager:secret-id.
CloudFormation retrieves the password dynamically at runtime during stack operations.
This prevents sensitive data from being recorded in the template or stack history.
3
Execute the stack creation or update command with the --disable-rollback CLI option.
If a deployment failure occurs, the stack remains in a failed state rather than rolling back.
This allows the developer to inspect the state and logs of the failed resources directly.

Anahtar Kavram

AWS CloudFormation secure parameter resolution and deployment troubleshooting
Bu soruyu puanla

Konular

AWS CloudFormation

Bu konudan daha fazla soru