Examkin

Soru

Zorluk: OrtaAWS CloudFormation

A developer is preparing to update an AWS CloudFormation stack that manages a production backend application. The update involves introducing a new external service API key that must be stored securely with support for automatic rotation. Additionally, the developer must ensure that any manual, out-of-band changes previously made to the stack's resources are identified and resolved before the update is performed to prevent deployment failures.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

  1. Store the API key in AWS Secrets Manager, and reference it in the CloudFormation template using a dynamic reference.Cevap
  2. Run drift detection on the CloudFormation stack, identify any drifted resources, and update the template or import resources to resolve the differences before updating the stack.Cevap
  3. C
    Store the API key in Systems Manager Parameter Store as a Standard parameter, and reference it in the CloudFormation template using a Systems Manager dynamic reference.
  4. D
    Modify the drifted resources manually in the AWS Management Console to match the updated template configurations, then apply the stack update.
  5. E
    Initiate the stack update directly, and if a failure occurs, manually delete the resource that caused the rollback while the stack is in the ROLLBACK_IN_PROGRESS state.

Cevap

Storing the API key in AWS Secrets Manager and referencing it via a dynamic reference, and running drift detection to identify and resolve drifted resources before updating the stack.
Storing the API key in AWS Secrets Manager satisfies the requirements for secure storage and automatic rotation, and referencing it via a dynamic reference ensures security. Running drift detection identifies any out-of-band changes that would cause the stack update to fail, allowing the developer to synchronize the template and actual resource configurations before deploying the update.

Adım Adım Çözüm

1
Select the appropriate storage service for the API key.
AWS Secrets Manager is chosen because it supports automatic rotation and secure credential storage.
Systems Manager Parameter Store does not offer native automatic rotation for secrets, whereas Secrets Manager does.
2
Integrate the secret securely in the CloudFormation template.
Reference the secret using the Secrets Manager dynamic reference format in the template.
This prevents hardcoding sensitive credentials in the template and allows retrieval at deployment time.
3
Identify out-of-band resource modifications.
Execute drift detection on the CloudFormation stack.
Drift detection reveals which resources have been modified outside of CloudFormation control.
4
Resolve resource drift before deploying the update.
Update the template to match the drifted state or import/re-import resources as necessary.
This ensures the stack state is synchronized with the template, preventing deployment conflicts and rollback failures.

Anahtar Kavram

CloudFormation update mechanics, drift detection, and secure parameter retrieval.
Bu soruyu puanla

Konular

AWS CloudFormation

Bu konudan daha fazla soru