Examkin

Soru

Zorluk: OrtaAWS CloudFormation

A developer is managing an application stack using AWS CloudFormation. The stack contains an Amazon RDS DB instance and an Amazon EC2 instance within an Amazon VPC. The developer has two new requirements:

1. Securely store the database credentials and ensure they are rotated automatically every 3030 days.
2. Detect any manual configuration changes made directly to the EC2 security group and restore the security group to the state defined in the CloudFormation template.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager, configure automatic rotation, and reference the secret in the CloudFormation template using a dynamic reference.Cevap
  2. Perform drift detection on the CloudFormation stack, review the drifted resources, and manually edit the security group in the Amazon VPC console to match the template configuration.Cevap
  3. C
    Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter, configure the built-in Parameter Store rotation schedule, and reference it in the template using a dynamic reference.
  4. D
    Use the CloudFormation console to run drift detection, select the drifted security group, and click the Reconcile Drift button to automatically overwrite the live resource configurations with the template state.
  5. E
    Initiate a stack update using a modified template to trigger a rollback, then use the ContinueUpdateRollback API while the stack is in the ROLLBACK_IN_PROGRESS state to force the security group back to its original state.

Cevap

Store the database credentials in AWS Secrets Manager with automatic rotation, reference it via dynamic references, perform drift detection, and manually revert the out-of-band security group changes.
The correct combination is to store the credentials in AWS Secrets Manager and use dynamic references, which supports the 3030-day rotation requirement, and to use drift detection to identify out-of-band changes, followed by manual remediation to revert the security group to the configuration defined in the template.

Adım Adım Çözüm

1
Evaluate the database credential rotation requirement.
AWS Secrets Manager is the correct service because it natively supports secret rotation (such as RDS credentials) every 3030 days, whereas Parameter Store does not have built-in rotation.
Choosing the correct secrets management service ensures security compliance and automatic rotation requirements are met.
2
Address the dynamic reference requirement in the CloudFormation template.
Use dynamic references to retrieve the secret securely without hardcoding parameters.
Dynamic references allow CloudFormation to pull secrets securely from Secrets Manager during stack creation or updates.
3
Evaluate how to detect and remediate out-of-band changes (drift) in CloudFormation.
Run drift detection on the stack to identify which resources differ from the template. Because CloudFormation does not have an automatic one-click remediation feature, manually modify the resource (security group) back to the template specifications.
This identifies the exact drift and brings the resource back to the desired configuration manually, correcting the out-of-band change.

Anahtar Kavram

AWS CloudFormation Drift Detection and secrets management integration
Bu soruyu puanla

Konular

AWS CloudFormation

Bu konudan daha fazla soru