Examkin

Soru

Zorluk: ZorAWS CloudFormation

A developer is managing a web application deployed using an AWS CloudFormation stack. The stack includes an Amazon ECS task definition, an IAM execution role, and an Amazon DynamoDB table. During a troubleshooting session, an administrator manually deleted the IAM execution role directly from the IAM Console. Subsequently, the developer attempted to update the CloudFormation stack to adjust the CPU allocation for the ECS tasks. The update failed, and the stack is now stuck in the UPDATE_ROLLBACK_FAILED state. The developer needs to resolve the rollback failure and successfully apply the new CPU allocation. Which two actions should the developer take to achieve this? (Select TWO.)

  1. Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template.Cevap
  2. Invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.Cevap
  3. C
    Invoke the update-stack operation on the stack with the --force-update parameter to override the failed rollback state.
  4. D
    Run drift detection on the stack and select the auto-remediate option to restore the deleted IAM execution role.
  5. E
    Update the CloudFormation stack template to use a different IAM execution role name, and then execute the rollback-stack CLI command.

Cevap

Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template, and then invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.
When a resource is deleted manually out-of-band and a subsequent stack update fails and rolls back, the rollback itself fails because CloudFormation expects the deleted resource to exist. To resolve the UPDATE_ROLLBACK_FAILED state, the developer must first manually recreate the deleted resource with the exact name and configuration specified in the template. After resolving the underlying cause, the developer must call continue-update-rollback to resume the rollback process and return the stack to a stable state, allowing future updates.

Adım Adım Çözüm

1
Identify the cause of the failed rollback by reviewing the stack events in the CloudFormation console or using the CLI.
The log events show that the IAM execution role is missing (deleted out-of-band), causing the rollback to fail because CloudFormation cannot update or delete resources depending on the role.
Before resolving the rollback state, you must identify which resource is missing or failed during the rollback process.
2
Manually recreate the deleted IAM execution role with the exact name, path, and configuration expected by the stack.
The IAM role exists again with the identical ARN and properties.
CloudFormation rollback actions reference the deleted resource by its physical ID/ARN; recreating it allows the cleanup or rollback operations to run successfully.
3
Run the continue-update-rollback command or use the AWS Console to continue rollback.
The stack successfully rolls back to the UPDATE_ROLLBACK_COMPLETE state.
This transitions the stack out of the blocked UPDATE_ROLLBACK_FAILED state into a stable state.
4
Initiate a new stack update with the updated template to modify the ECS task definition CPU limits.
The update finishes successfully, and the stack reaches the UPDATE_COMPLETE state.
Once the stack is in a stable UPDATE_ROLLBACK_COMPLETE state, regular updates can be performed safely.

Anahtar Kavram

Recovering from CloudFormation UPDATE_ROLLBACK_FAILED due to manual out-of-band resource deletion.
Bu soruyu puanla

Konular

AWS CloudFormation

Bu konudan daha fazla soru