Examkin

AWS CloudFormation

57 soru

Tüm türler57Çoktan seçmeli29Çoklu seçim28
Soru 1Soru →

A developer is managing an AWS CloudFormation stack for a production application. After a failed update to an Amazon RDS database instance, the stack is stuck in the UPDATE_ROLLBACK_FAILED state. The developer discovers that another team member had previously made manual, out-of-band configuration changes to the database instance directly in the AWS Console. How should the developer resolve this situation and successfully perform the stack update?

Cevabı ve açıklamayı göster

Cevap: Identify the manual changes, use the CloudFormation console or CLI to run the ContinueUpdateRollback action to return the stack to a stable state, update the template to reflect the actual resource configuration, and then perform the update.

Cevap

To resolve an UPDATE_ROLLBACK_FAILED state caused by out-of-band changes, the developer must run the ContinueUpdateRollback action to stabilize the stack, align the template with the actual resource state, and then perform the update.
Executing the ContinueUpdateRollback action is the standard AWS procedure to recover a stack from the UPDATE_ROLLBACK_FAILED state. Once the stack is stabilized to UPDATE_ROLLBACK_COMPLETE, the developer can align the template with the actual drifted state of the database and safely run the update.

Adım Adım Çözüm

1
Identify manual configuration changes that caused the rollback failure.
Find the drift or discrepancy between the template and the actual resource state.
Manual out-of-band changes prevent CloudFormation from rolling back resources to their expected state.
2
Execute the ContinueUpdateRollback operation via the CLI or AWS Console.
The stack transitions from UPDATE_ROLLBACK_FAILED to UPDATE_ROLLBACK_COMPLETE.
This action bypasses or retries the failed rollback step, bringing the stack back to a stable state where updates are permitted.
3
Align the template with the actual configuration of the resources and redeploy.
The stack is successfully updated with no configuration drift.
Ensuring the template matches the real-world state prevents future update or rollback failures.

Anahtar Kavram

Resolving CloudFormation stack update rollback failures caused by resource drift
Tahmini Süre:1m 30s
Soru 2Soru →

A developer is configuring an AWS CloudFormation template to deploy an application that requires a database password. The password must be stored securely and rotated automatically every 30 days. Additionally, the developer must ensure that if a stack update fails, the resources are reverted to their previous working state. Which CloudFormation configurations and features should the developer use to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Use a CloudFormation dynamic reference to retrieve the database password from AWS Secrets Manager.; Allow the default CloudFormation behavior to roll back the stack automatically to its last stable state if the update fails.

Cevap

To securely reference a rotating password and ensure automatic rollback on failure, the developer should use a dynamic reference to retrieve the database password from AWS Secrets Manager and allow CloudFormation to execute its default automatic rollback behavior.
To retrieve a secret that rotates automatically, using a dynamic reference to AWS Secrets Manager is the correct choice because Secrets Manager natively handles automatic secret rotation. Allowing the default CloudFormation rollback behavior ensures that any failed updates are automatically reverted to the last stable configuration without manual intervention.

Adım Adım Çözüm

1
Select a secure storage service for the database password that supports rotation.
Identify AWS Secrets Manager as the appropriate service because it supports automatic rotation, unlike Systems Manager Parameter Store.
The requirements demand a secure password storage solution that rotates every 30 days.
2
Integrate the secure storage with the CloudFormation template.
Configure a dynamic reference in the template to fetch the password from AWS Secrets Manager at deployment time.
Dynamic references retrieve sensitive values from external systems without exposing them in plaintext inside the template.
3
Evaluate the rollback strategy for failed updates.
Ensure default automatic rollback is enabled for the stack.
CloudFormation's default behavior is to roll back to the last stable state automatically when an update fails, satisfying the requirement to revert changes.

Anahtar Kavram

AWS CloudFormation manages resources declaratively. Using dynamic references to AWS Secrets Manager handles rotating credentials securely, while default stack rollback behavior ensures automated state recovery from update failures.
Tahmini Süre:1m 0s
Soru 3Soru →

A developer manages a production application stack deployed via AWS CloudFormation. The stack consists of an Amazon RDS DB instance and an Auto Scaling group of Amazon EC2 instances. During a recent deployment, a stack update failed while attempting to modify the DB instance parameters, and the subsequent automatic rollback also failed, leaving the stack in the UPDATE_ROLLBACK_FAILED state. The developer needs to update the launch template of the Auto Scaling group to apply a critical security patch immediately without deleting the existing stack or losing DB instance data. How can the developer successfully apply the launch template update to the stack?

Cevabı ve açıklamayı göster

Cevap: Run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. Once the stack status transitions to `UPDATE_ROLLBACK_COMPLETE`, perform the stack update with the modified Auto Scaling group configuration.

Cevap

Run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. Once the stack status transitions to `UPDATE_ROLLBACK_COMPLETE`, perform the stack update with the modified Auto Scaling group configuration.
The correct answer is to run the `continue-update-rollback` command and specify the RDS DB instance in the resources to skip parameter. When a CloudFormation stack update fails and the rollback also fails, the stack enters the `UPDATE_ROLLBACK_FAILED` state. To perform further updates, the developer must get the stack into a stable state. By continuing the update rollback and skipping the failing DB instance resource, CloudFormation can successfully roll back the rest of the stack, transitioning it to the `UPDATE_ROLLBACK_COMPLETE` state. Once in this stable state, the developer can initiate the stack update for the Auto Scaling group.

Adım Adım Çözüm

1
Identify the resource causing the rollback failure (the Amazon RDS DB instance) and execute the `continue-update-rollback` command (or use the console equivalent).
The stack bypasses the failed rollback of the DB instance and rolls back the other resources successfully.
This is necessary because a stack in the `UPDATE_ROLLBACK_FAILED` state cannot be updated directly; it must first reach a stable state.
2
Wait for the stack status to transition from `UPDATE_ROLLBACK_FAILED` to `UPDATE_ROLLBACK_COMPLETE`.
The stack enters a stable, updatable state.
CloudFormation only allows stack updates when the stack is in a stable status such as `UPDATE_ROLLBACK_COMPLETE` or `CREATE_COMPLETE`.
3
Perform the stack update using the template containing the modified launch template configuration for the Auto Scaling group.
The Auto Scaling group is updated successfully with the critical security patch.
This applies the required changes to the Auto Scaling group now that the stack is in an updatable state.

Anahtar Kavram

Handling CloudFormation stack updates and failures by using the ContinueUpdateRollback action to skip failing resources and return the stack to a stable state.
Soru 4Soru →

A developer is managing an application stack using AWS CloudFormation. The stack contains an Amazon RDS DB instance and an Amazon EC2 instance within an Amazon VPC. The developer has two new requirements:

1. Securely store the database credentials and ensure they are rotated automatically every 3030 days.
2. Detect any manual configuration changes made directly to the EC2 security group and restore the security group to the state defined in the CloudFormation template.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database credentials in AWS Secrets Manager, configure automatic rotation, and reference the secret in the CloudFormation template using a dynamic reference.; Perform drift detection on the CloudFormation stack, review the drifted resources, and manually edit the security group in the Amazon VPC console to match the template configuration.

Cevap

Store the database credentials in AWS Secrets Manager with automatic rotation, reference it via dynamic references, perform drift detection, and manually revert the out-of-band security group changes.
The correct combination is to store the credentials in AWS Secrets Manager and use dynamic references, which supports the 3030-day rotation requirement, and to use drift detection to identify out-of-band changes, followed by manual remediation to revert the security group to the configuration defined in the template.

Adım Adım Çözüm

1
Evaluate the database credential rotation requirement.
AWS Secrets Manager is the correct service because it natively supports secret rotation (such as RDS credentials) every 3030 days, whereas Parameter Store does not have built-in rotation.
Choosing the correct secrets management service ensures security compliance and automatic rotation requirements are met.
2
Address the dynamic reference requirement in the CloudFormation template.
Use dynamic references to retrieve the secret securely without hardcoding parameters.
Dynamic references allow CloudFormation to pull secrets securely from Secrets Manager during stack creation or updates.
3
Evaluate how to detect and remediate out-of-band changes (drift) in CloudFormation.
Run drift detection on the stack to identify which resources differ from the template. Because CloudFormation does not have an automatic one-click remediation feature, manually modify the resource (security group) back to the template specifications.
This identifies the exact drift and brings the resource back to the desired configuration manually, correcting the out-of-band change.

Anahtar Kavram

AWS CloudFormation Drift Detection and secrets management integration
Soru 5Soru →

An operations team manages a production application infrastructure stack deployed via AWS CloudFormation. The stack consists of an Amazon ECS service, an Application Load Balancer (ALB), and an Amazon DynamoDB table. During a previous template update, a resource configuration error caused a failure, leaving the stack stuck in the `UPDATE_ROLLBACK_FAILED` state. Additionally, a drift detection scan indicates that another team member manually modified the ALB's security group out-of-band to allow traffic from a new partner IP range. The team must successfully deploy the new application updates while preserving the manual security group modifications. Which combination of actions should the team take to meet these requirements? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run the `continue-update-rollback` command on the stack to return it to the `UPDATE_ROLLBACK_COMPLETE` state.; Update the CloudFormation template definition for the security group to match the manually allowed IP ranges before initiating the next stack update.

Cevap

To resolve this issue, the team must run the `continue-update-rollback` command on the stack to return it to the `UPDATE_ROLLBACK_COMPLETE` state, and update the CloudFormation template definition for the security group to match the manually allowed IP ranges before initiating the next stack update.
To successfully deploy new updates while preserving the manual security group configurations, the team must first stabilize the stack by running `continue-update-rollback`, which moves it from `UPDATE_ROLLBACK_FAILED` to `UPDATE_ROLLBACK_COMPLETE`. Secondly, they must update the template code to match the manually added IP range rules. This reconciles the drift and prevents CloudFormation from overwriting the manual changes during the subsequent update.

Adım Adım Çözüm

1
Address the failed rollback state
The stack transitions to the `UPDATE_ROLLBACK_COMPLETE` state.
CloudFormation stacks in the `UPDATE_ROLLBACK_FAILED` state do not accept updates. Running `continue-update-rollback` retries or bypasses the failed rollback actions to bring the stack back to a stable state.
2
Reconcile the configuration drift
The template definition is aligned with the live configuration of the security group.
Since the security group has been manually modified out-of-band, the template code must be updated to match these live settings. Otherwise, the next stack update would overwrite these manual rules or fail due to drift.
3
Perform the stack update
The stack is updated with the new template changes without losing the security group rules.
Once the stack is in a stable state and the template has been updated to reflect the drift, the stack update can proceed safely.

Anahtar Kavram

CloudFormation Stack Recovery and Drift Reconciliation
Soru 6Soru →

A developer is managing a production database infrastructure stack using AWS CloudFormation. The template defines an Amazon RDS DB instance whose master password must be rotated automatically every 15 days. Additionally, a manual modification to the DB instance's security group settings made via the AWS Console has caused a subsequent CloudFormation stack update to fail, leaving the stack stuck in the UPDATE_ROLLBACK_FAILED state.

How should the developer securely reference the rotated password in the template and resolve the stack update failure?

Cevabı ve açıklamayı göster

Cevap: Store the password in AWS Secrets Manager and reference it using a dynamic reference in the template. To resolve the UPDATE_ROLLBACK_FAILED state, run the ContinueUpdateRollback action, manually correcting the out-of-band security group changes if necessary to match the expected state.

Cevap

Store the password in AWS Secrets Manager and reference it using a dynamic reference in the template. To resolve the UPDATE_ROLLBACK_FAILED state, run the ContinueUpdateRollback action, manually correcting the out-of-band security group changes if necessary to match the expected state.
AWS Secrets Manager is the correct service for credentials that require automatic rotation. By referencing the secret via a dynamic reference in the template, CloudFormation retrieves the rotated credential securely. If an update fails and the rollback gets blocked (UPDATE_ROLLBACK_FAILED state), standard update actions are unavailable. The developer must invoke ContinueUpdateRollback to resume the rollback, manually aligning the out-of-band changes with the expected state to allow the rollback to finish.

Adım Adım Çözüm

1
Select the correct credential storage service based on requirements
AWS Secrets Manager is chosen for password storage.
The security requirement states that the password must be rotated every 15 days. AWS Secrets Manager offers native, built-in support for rotating credentials, whereas Systems Manager Parameter Store does not support automated rotation without writing custom Lambda rotation logic.
2
Define the CloudFormation referencing method
Reference the secret using a dynamic reference string in the template.
Using a dynamic reference format like '{{resolve:secretsmanager:secret-id:SecretString:password}}' allows CloudFormation to securely pull the latest rotated password version during deployments without exposing the value in plaintext.
3
Identify the stack troubleshooting procedure
Invoke the ContinueUpdateRollback operation.
When a stack update fails and the subsequent rollback also fails, the stack gets locked in UPDATE_ROLLBACK_FAILED. Regular updates are blocked in this state. The developer must call ContinueUpdateRollback, which allows the rollback to proceed (often requiring manual reconciliation of the drifted resource in the console or CLI to match the rollback target configuration first).

Anahtar Kavram

Managing Secrets Manager dynamic references with auto-rotation, and troubleshooting CloudFormation rollback failures caused by drift.
Soru 7Soru →

A developer needs to audit a production environment deployed via AWS CloudFormation because some resources may have been modified manually outside of the stack template. The developer wants to identify these out-of-band changes.

Which of the following actions should the developer perform to detect these modifications? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Run drift detection on the entire CloudFormation stack from the AWS CloudFormation console or the AWS CLI.; Review the drift status details of the stack and individual resources to compare the actual and expected configurations.

Cevap

Running drift detection on the CloudFormation stack and reviewing the drift status details to compare actual and expected configurations are the correct methods to identify manual changes.
To identify manual modifications made outside of CloudFormation, a developer can run drift detection on the stack. Reviewing the drift status details shows exactly which resources have drifted and how their actual configuration properties differ from the expected template configuration.

Adım Adım Çözüm

1
Initiate a drift detection operation on the target stack.
CloudFormation scans the resources in the stack and compares them to the template definition.
This establishes the current state baseline and flags any discrepancies.
2
Review the drift status results in the console or CLI output.
The developer identifies modified properties, values, and status for drifted resources.
This provides granular details of the changes that were made manually outside of CloudFormation.

Anahtar Kavram

AWS CloudFormation Drift Detection
Soru 8Soru →

A developer is managing a production web application deployed via an AWS CloudFormation stack. The stack consists of an Amazon RDS DB instance, an Amazon EC2 Auto Scaling group, and an IAM role associated with the EC2 instances. To troubleshoot a connection issue, an administrator manually modified the EC2 security group rules and deleted the IAM role directly in the AWS Management Console. During a subsequent stack update to upgrade the database instance class, the update failed and the stack is now in the UPDATE_ROLLBACK_FAILED state. Which two actions should the developer take to resolve the stack status and reconcile the resource configurations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Manually recreate the deleted IAM role using the exact name and configuration it had prior to deletion, and then initiate the continue-update-rollback action.; Execute the continue-update-rollback command and specify the logical ID of the deleted IAM role in the resources-to-skip parameter.

Cevap

To resolve the UPDATE_ROLLBACK_FAILED state, the developer should either manually recreate the deleted IAM role and continue the rollback, or execute continue-update-rollback while skipping the deleted IAM role.
The correct options identify the two supported methods for resolving a stack stuck in the UPDATE_ROLLBACK_FAILED state. Recreating the deleted IAM role allows CloudFormation to find and delete/modify it during the rollback phase, which enables the rollback to complete successfully. Alternatively, calling the continue-update-rollback command and choosing to skip the deleted IAM role permits the rollback operation to skip that specific resource and successfully transition the stack to the UPDATE_ROLLBACK_COMPLETE state.

Adım Adım Çözüm

1
Analyze the stack status and event logs to identify the exact resource causing the rollback failure.
The logs indicate that the rollback failed because the IAM role referenced in the stack template was not found.
Before resolving the rollback failure, the root cause of the failure must be identified.
2
Choose to either restore the missing dependency or skip the resource during rollback.
Recreating the role allows the rollback to clean it up or update it normally. Alternatively, skipping the role allows the rollback to finish while leaving the resource state as-is.
CloudFormation requires either finding the resource to modify or delete it, or being explicitly told to skip it to complete the rollback sequence.
3
Perform a drift detection after the stack reaches a stable state to identify the out-of-band security group changes.
The drift detection report details the exact differences between the template and the actual security group rules.
This identifies all manual out-of-band changes that need to be reconciled manually or by updating the template.

Anahtar Kavram

CloudFormation Stack Rollback Failure Resolution
Soru 9Soru →

A developer is managing a web application deployed using an AWS CloudFormation stack. The stack includes an Amazon ECS task definition, an IAM execution role, and an Amazon DynamoDB table. During a troubleshooting session, an administrator manually deleted the IAM execution role directly from the IAM Console. Subsequently, the developer attempted to update the CloudFormation stack to adjust the CPU allocation for the ECS tasks. The update failed, and the stack is now stuck in the UPDATE_ROLLBACK_FAILED state. The developer needs to resolve the rollback failure and successfully apply the new CPU allocation. Which two actions should the developer take to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template.; Invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.

Cevap

Manually recreate the IAM execution role with the exact same name and configuration as defined in the CloudFormation template, and then invoke the continue-update-rollback operation on the CloudFormation stack to complete the rollback process.
When a resource is deleted manually out-of-band and a subsequent stack update fails and rolls back, the rollback itself fails because CloudFormation expects the deleted resource to exist. To resolve the UPDATE_ROLLBACK_FAILED state, the developer must first manually recreate the deleted resource with the exact name and configuration specified in the template. After resolving the underlying cause, the developer must call continue-update-rollback to resume the rollback process and return the stack to a stable state, allowing future updates.

Adım Adım Çözüm

1
Identify the cause of the failed rollback by reviewing the stack events in the CloudFormation console or using the CLI.
The log events show that the IAM execution role is missing (deleted out-of-band), causing the rollback to fail because CloudFormation cannot update or delete resources depending on the role.
Before resolving the rollback state, you must identify which resource is missing or failed during the rollback process.
2
Manually recreate the deleted IAM execution role with the exact name, path, and configuration expected by the stack.
The IAM role exists again with the identical ARN and properties.
CloudFormation rollback actions reference the deleted resource by its physical ID/ARN; recreating it allows the cleanup or rollback operations to run successfully.
3
Run the continue-update-rollback command or use the AWS Console to continue rollback.
The stack successfully rolls back to the UPDATE_ROLLBACK_COMPLETE state.
This transitions the stack out of the blocked UPDATE_ROLLBACK_FAILED state into a stable state.
4
Initiate a new stack update with the updated template to modify the ECS task definition CPU limits.
The update finishes successfully, and the stack reaches the UPDATE_COMPLETE state.
Once the stack is in a stable UPDATE_ROLLBACK_COMPLETE state, regular updates can be performed safely.

Anahtar Kavram

Recovering from CloudFormation UPDATE_ROLLBACK_FAILED due to manual out-of-band resource deletion.
Soru 10Soru →

A developer is deploying a database-backed web application using an AWS CloudFormation template. The application requires a database password that must be automatically rotated every 30 days, and a database port setting that is non-sensitive and static. Which of the following approaches represent best practices for managing these configurations? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager, enable automatic rotation, and retrieve the password in the CloudFormation template using a dynamic reference.; Store the database port in AWS Systems Manager Parameter Store as a standard parameter, and retrieve it in the CloudFormation template using a dynamic reference.

Cevap

Store the database password in AWS Secrets Manager with automatic rotation, and store the database port in AWS Systems Manager Parameter Store, referencing both via dynamic references.
The correct approach is to store the database password in AWS Secrets Manager because it is sensitive and requires automatic rotation, and store the database port in AWS Systems Manager Parameter Store because it is static and non-sensitive. Both values should be retrieved using dynamic references in the CloudFormation template to avoid hardcoding sensitive data and to ensure secure, automated retrieval at deployment time.

Adım Adım Çözüm

1
Determine the security and lifecycle needs of each configuration item.
The database password is sensitive and requires automatic rotation; the database port is non-sensitive and static.
Identifying these traits ensures that resources are configured using the most secure and cost-efficient AWS services.
2
Select the correct storage service for the sensitive password.
AWS Secrets Manager is selected.
Secrets Manager natively supports automatic rotation and secure encryption, which are required for the database password.
3
Select the correct storage service for the non-sensitive port.
AWS Systems Manager Parameter Store is selected.
Parameter Store standard parameters are free and ideal for static, non-sensitive parameters, avoiding the cost of Secrets Manager.
4
Reference both values dynamically inside the CloudFormation template.
Dynamic references are added to the template parameters.
Dynamic references allow the stack to fetch the values at deploy time without storing sensitive data in the template definition.

Anahtar Kavram

AWS CloudFormation templates should integrate with AWS Systems Manager Parameter Store and AWS Secrets Manager using dynamic references to securely and cost-effectively inject parameters based on their sensitivity and rotation requirements.
Soru 11Soru →

A developer is managing an application infrastructure deployed using AWS CloudFormation. During a stack update, the update fails, and the stack enters the UPDATE_ROLLBACK_FAILED state because an IAM role resource defined in the template was manually deleted from the AWS account out-of-band. Which two actions should the developer take to resolve this issue and return the stack to a usable state? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Manually recreate the IAM role with the exact same name and configuration that existed prior to the deletion, and then continue the update rollback; Perform the ContinueUpdateRollback operation and list the deleted IAM role in the ResourcesToSkip parameter

Cevap

To resolve the UPDATE_ROLLBACK_FAILED state caused by an out-of-band deletion, the developer must either manually recreate the IAM role with the same name and config before continuing the rollback, or execute the ContinueUpdateRollback operation while specifying the deleted IAM role in the ResourcesToSkip parameter.
The correct actions are to either recreate the deleted resource manually with the same name to allow the rollback process to interact with it, or skip the resource entirely using the ContinueUpdateRollback operation. Both approaches allow the stack to exit the UPDATE_ROLLBACK_FAILED state.

Adım Adım Çözüm

1
Identify the root cause of the rollback failure by inspecting the CloudFormation stack events.
The stack is confirmed to be in the UPDATE_ROLLBACK_FAILED state due to a missing IAM role resource that was deleted out-of-band.
Understanding why the rollback failed is necessary to choose the appropriate recovery strategy.
2
Resolve the rollback blockage by either manually recreating the deleted resource with the matching name or using ContinueUpdateRollback with the ResourcesToSkip parameter.
The stack successfully rolls back to the UPDATE_ROLLBACK_COMPLETE state.
The stack must be brought to a stable completed rollback state before any new update operations can be initiated.
3
Perform a stack update to synchronize any desired configuration changes or recreate resources within the template.
The stack is updated successfully to the UPDATE_COMPLETE state.
This ensures that all resources are correctly aligned with the CloudFormation template.

Anahtar Kavram

Handling CloudFormation stack update rollback failures caused by out-of-band resource deletion.
Soru 12Soru →

A developer deployed an infrastructure stack using AWS CloudFormation. Later, a system administrator manually modified the port settings of an Amazon EC2 Security Group directly in the Amazon VPC Console to troubleshoot a connection issue. The developer needs to identify which specific configurations in the deployed stack no longer match the CloudFormation template definition. Which CloudFormation feature should the developer use to achieve this?

Cevabı ve açıklamayı göster

Cevap: Use CloudFormation drift detection to compare the stack's actual configuration with the expected template configuration.

Cevap

Use CloudFormation drift detection to compare the stack's actual configuration with the expected template configuration.
Drift detection is a native CloudFormation feature designed to identify stack resources that have been modified outside of CloudFormation management (out-of-band). It compares the actual state of the resource properties with the expected state defined in the template.

Adım Adım Çözüm

1
Analyze the scenario to identify that an out-of-band manual modification has been made to a CloudFormation-managed resource.
The Security Group state has diverged from the template definition.
This establishes that the core issue is configuration drift.
2
Select the CloudFormation feature that inspects and reports on manual deviations.
CloudFormation drift detection is identified as the correct tool.
Drift detection compares stack resource property values against the expected template values to detect differences.

Anahtar Kavram

CloudFormation Drift Detection
Tahmini Süre:45s
Soru 13Soru →

A developer is managing an application deployed via AWS CloudFormation. The application's database credentials are stored in AWS Secrets Manager and referenced in the CloudFormation template using the dynamic reference `{{resolve:secretsmanager:ProductionDBSecret:SecretString:Password}}` within the `UserData` property of an `AWS::EC2::LaunchTemplate` resource.

The database administrator rotates the database password in AWS Secrets Manager. Subsequently, the developer initiates a stack update to increase the `MaxSize` property of the `AWS::AutoScaling::AutoScalingGroup` resource that uses this launch template. The stack update completes successfully, but the newly launched EC2 instances fail to connect to the database, while existing instances continue to function until their cached credentials expire.

What is the cause of this issue, and how should the developer resolve it?

Cevabı ve açıklamayı göster

Cevap: The Launch Template resource was not modified during the stack update, so CloudFormation did not re-resolve the dynamic reference to fetch the new password. The developer must update the template by appending the new secret's version ID or version stage to the dynamic reference to force a Launch Template update.

Cevap

The Launch Template resource was not modified during the stack update, so CloudFormation did not re-resolve the dynamic reference. The developer must update the template by appending the new secret's version ID or version stage to the dynamic reference to force a Launch Template update.
CloudFormation resolves dynamic references only during stack creation or when the specific resource containing the dynamic reference is updated. Since the stack update only modified the `MaxSize` property of the `AWS::AutoScaling::AutoScalingGroup` resource, the `AWS::EC2::LaunchTemplate` resource was not modified, and CloudFormation did not re-resolve the Secrets Manager dynamic reference. Consequently, the launch template continued to use the old resolved password value. To resolve this, the template must be updated to force an update of the launch template resource. Appending the new secret's version ID or version stage (such as the specific version UUID) to the dynamic reference changes the template definition of the launch template, forcing CloudFormation to update the launch template and retrieve the new secret value.

Adım Adım Çözüm

1
Analyze why the new EC2 instances are failing to connect.
The new instances are launched using the launch template that still contains the old database password because the dynamic reference was not re-resolved.
CloudFormation only resolves dynamic references when the resource defining them is created or updated. The stack update only changed the Auto Scaling group's MaxSize, leaving the Launch Template untouched.
2
Determine the correct method to force CloudFormation to resolve the updated secret.
The Launch Template resource must be modified in the template so that CloudFormation initiates an update for it.
By changing the resource's definition, CloudFormation is triggered to update the Launch Template and fetch the updated value of the dynamic reference.
3
Apply the change using the Secrets Manager dynamic reference version ID/stage suffix.
Update the dynamic reference to specify the new version ID (e.g., `{{resolve:secretsmanager:ProductionDBSecret:SecretString:Password::version-id}}`).
This updates the launch template resource in the CloudFormation template, prompting CloudFormation to re-resolve the reference during the stack update.

Anahtar Kavram

CloudFormation dynamic references are only resolved during resource creation or updates. Changing properties of other resources (like Auto Scaling group size) does not trigger re-resolution of dynamic references in unchanged resources.

Alternatif Yöntem

Another way to force the launch template to update and re-resolve the dynamic reference is to update a non-disruptive parameter or property on the launch template itself, such as adding or changing a metadata property or changing the launch template version in the Auto Scaling group template definition.
Tahmini Süre:3m 0s
Soru 14Soru →

A developer manages a production environment deployed using an AWS CloudFormation stack. The stack contains an Amazon RDS DB instance, an Amazon EC2 instance, and an IAM role. A system administrator manually changed the security group of the RDS DB instance in the Amazon VPC Console to address a transient connection issue.

During a subsequent stack update to upgrade the database engine version and add policies to the IAM role, the update fails during the RDS DB instance modification. CloudFormation attempts to roll back the changes, but the rollback fails and remains stuck in the `UPDATE_ROLLBACK_FAILED` state because the manually modified security group configuration prevents the database rollback. The developer must complete the stack update, ensuring the new IAM policies are applied and the database is upgraded.

Which sequence of actions must the developer perform to resolve this issue?

Cevabı ve açıklamayı göster

Cevap: Execute `aws cloudformation continue-update-rollback` specifying the logical ID of the RDS DB instance in the `--resources-to-skip` parameter to transition the stack to `UPDATE_ROLLBACK_COMPLETE`. Revert the manual security group modifications on the RDS DB instance in the Amazon VPC Console to align the resource's physical state with the template, and then perform a new stack update with the corrected database engine version and the updated IAM role template.

Cevap

Execute `aws cloudformation continue-update-rollback` with the `--resources-to-skip` parameter for the RDS DB instance, revert the manual security group modifications in the console, and then perform a new stack update.
The correct sequence begins by executing the `continue-update-rollback` command and specifying the logical ID of the RDS DB instance in the `--resources-to-skip` parameter. This instructs CloudFormation to set the status of the RDS DB instance to update/rollback complete (leaving its physical state unchanged) and proceed with rolling back the rest of the stack, shifting the overall stack status to `UPDATE_ROLLBACK_COMPLETE`. Because skipping the resource leaves it inconsistent with the template, the developer must manually revert the out-of-band security group changes in the VPC Console to match the template. Once reconciled, a new stack update can be run successfully to apply the database upgrade and the new IAM role policies.

Adım Adım Çözüm

1
Invoke the continue-update-rollback command with skipped resources
The command `aws cloudformation continue-update-rollback --stack-name <stack-name> --resources-to-skip <RDS-Logical-ID>` is executed, transitioning the stack to the `UPDATE_ROLLBACK_COMPLETE` state.
When a stack is stuck in `UPDATE_ROLLBACK_FAILED`, you must use `continue-update-rollback`. Specifying the failing resource in `--resources-to-skip` allows CloudFormation to bypass rolling back that specific resource and successfully roll back the rest of the stack (such as the IAM role).
2
Reconcile resource drift manually
The manual changes made to the RDS DB instance security group are reverted in the AWS Management Console to match the configuration defined in the template.
Skipping a resource leaves its physical state inconsistent with the stack template. To avoid future update failures due to drift, the physical resource must be aligned with the template before launching a new update.
3
Perform the stack update again
The stack update is executed with the corrected configuration, upgrading the database engine version and applying the new IAM policies.
With the stack in a stable state (`UPDATE_ROLLBACK_COMPLETE`) and the resources reconciled, the update can now be cleanly processed.

Anahtar Kavram

Handling AWS CloudFormation UPDATE_ROLLBACK_FAILED states by skipping resources and reconciling out-of-band drift.
Tahmini Süre:3m 0s
Soru 15Soru →

A developer is writing an AWS CloudFormation template to deploy a web application. The application requires access to a database password that must be rotated automatically every 30 days.

Which approach should the developer use to reference this password in the CloudFormation template while meeting the security requirements?

Cevabı ve açıklamayı göster

Cevap: Retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager.

Cevap

Retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager.
The correct option is to retrieve the database password dynamically in the CloudFormation template using a dynamic reference to a secret stored in AWS Secrets Manager. Secrets Manager is designed specifically to handle sensitive information and provides built-in integration for automatic rotation of credentials. CloudFormation can securely fetch the current version of the secret during deployment using dynamic references.

Adım Adım Çözüm

1
Identify the rotation requirement.
The requirement specifies that the database password must be rotated automatically every 30 days.
AWS Secrets Manager natively supports automatic secrets rotation using AWS Lambda, whereas Systems Manager Parameter Store does not have a native, out-of-the-box automatic rotation feature.
2
Integrate the secret with CloudFormation.
Configure a dynamic reference pattern like '{{resolve:secretsmanager:secret-id}}' within the CloudFormation resource properties.
This allows CloudFormation to fetch the latest version of the secret at deployment time without hardcoding it or exposing it in plaintext.

Anahtar Kavram

AWS CloudFormation Dynamic References with AWS Secrets Manager
Soru 16Soru →

A developer attempts to create a new AWS CloudFormation stack to deploy a web application. The stack creation fails because of an invalid AMI ID parameter, and the stack enters the ROLLBACK_COMPLETE status. The developer updates the template with the correct AMI ID.

Which action should the developer take to deploy the resources successfully?

Cevabı ve açıklamayı göster

Cevap: Delete the stack in the ROLLBACK_COMPLETE status, and then create a new stack using the updated template.

Cevap

Delete the stack in the ROLLBACK_COMPLETE status, and then create a new stack using the updated template.
When a CloudFormation stack fails to create on its very first attempt, it rolls back all created resources and enters the ROLLBACK_COMPLETE status. Stacks in the ROLLBACK_COMPLETE status cannot be updated; they must be deleted before a new stack can be created with the same name and the corrected template.

Adım Adım Çözüm

1
Identify the stack's current state and origin of failure.
The stack failed during initial creation and rolled back successfully to the ROLLBACK_COMPLETE state.
Before deciding on a recovery action, the developer must determine if the stack was previously successful or if it failed on its first creation attempt.
2
Evaluate the update capability of the stack in the current state.
AWS CloudFormation does not allow update operations on stacks that fail initial creation (ROLLBACK_COMPLETE). Updates are only allowed on successfully created stacks or stacks that fail during a subsequent update (UPDATE_ROLLBACK_COMPLETE).
This determines whether the existing stack can be updated or must be recreated.
3
Perform stack cleanup and recreation.
Delete the failed stack and create a new one using the corrected template.
This removes the failed stack metadata from the account and allows the deployment to start fresh with the corrected parameters.

Anahtar Kavram

CloudFormation Stack Lifecycle and Rollback States
Soru 17Soru →

A developer is configuring an AWS CloudFormation template to deploy an Amazon RDS DB instance. The database requires a master password that must be stored securely and rotated automatically every 30 days to comply with company security policies. Which configuration should the developer use to reference and manage the password?

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.

Cevap

Store the database password in AWS Secrets Manager, and reference it in the CloudFormation template using a secretsmanager dynamic reference.
The correct option stores the database password in AWS Secrets Manager, which natively supports automatic rotation, and references it using the secretsmanager dynamic reference in the template. This ensures that the secret is kept secure and is retrieved dynamically during deployment.

Adım Adım Çözüm

1
Analyze the requirements: secure storage of a database password and support for automatic rotation.
Identify that AWS Secrets Manager is the appropriate service for credentials requiring automatic rotation, whereas Systems Manager Parameter Store does not support native rotation.
Choosing the correct AWS service ensures security compliance and automation features are utilized.
2
Determine how to reference the secret in the CloudFormation template.
Identify that the secretsmanager dynamic reference should be used.
Dynamic references retrieve sensitive information at deployment time without storing it in plaintext or parameters.

Anahtar Kavram

AWS CloudFormation Dynamic References and Secrets Management
Soru 18Soru →

A developer is managing a production infrastructure stack deployed via AWS CloudFormation. The stack contains an Amazon RDS DB instance and an Amazon ECS service. To prevent accidental replacement or deletion of the production database, the developer applies a stack policy to the stack. The policy contains a Deny statement for all update actions on the RDS DB instance resource, while allowing updates on all other resources.

The developer now needs to update the database engine version of the RDS DB instance. The developer attempts to perform a stack update with a template containing the new engine version, but the update fails due to the stack policy.

Which of the following is the correct method to update the database engine version while preserving the protective stack policy for future updates?

Cevabı ve açıklamayı göster

Cevap: Perform the stack update by using the AWS CLI update-stack command, passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter.

Cevap

Perform the stack update by using the AWS CLI update-stack command, passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter.
The correct answer is to perform the stack update by using the AWS CLI update-stack command while passing a temporary stack policy that allows the update to the database resource in the --stack-policy-during-update-body parameter. When a stack policy is associated with a CloudFormation stack, all resources are protected by default unless explicitly allowed. To update a protected resource, the developer must temporarily override the stack policy during the update process. The --stack-policy-during-update-body parameter allows providing a temporary policy that permits the update. Once the update completes, CloudFormation automatically reverts to the original stack policy, maintaining the protection for subsequent updates.

Adım Adım Çözüm

1
Define a temporary stack policy JSON document that explicitly allows updates (such as Update:Modify) to the target RDS DB instance resource.
A JSON stack policy document is created for temporary use during the update.
This policy is required to temporarily override the existing Deny rule on the database resource.
2
Run the aws cloudformation update-stack command with the --stack-policy-during-update-body flag, referencing the temporary stack policy.
CloudFormation executes the stack update and successfully applies the database engine version update.
Passing the temporary policy allows CloudFormation to bypass the permanent Deny rule for the duration of this single update transaction.
3
Verify that the update has completed and the stack status is UPDATE_COMPLETE.
The stack policy reverts to the original, permanent policy containing the Deny rule.
The temporary policy is only active during the update process, ensuring the database remains protected against accidental updates afterwards.

Anahtar Kavram

CloudFormation Stack Policies and temporary overrides during updates
Tahmini Süre:2m 30s
Soru 19Soru →

A developer is managing an AWS CloudFormation stack. The developer needs to update the stack template to add a new Amazon DynamoDB table, store a database password that requires automatic rotation, and store a non-sensitive configuration parameter. Which of the following actions should the developer take to accomplish this? (Select TWO.)

Geçerli olan tümünü seçin

Cevabı ve açıklamayı göster

Cevap: Store the database password in AWS Secrets Manager.; Store the non-sensitive configuration parameter in AWS Systems Manager Parameter Store.

Cevap

The developer should store the database password in AWS Secrets Manager and store the non-sensitive configuration parameter in Systems Manager Parameter Store.
The correct options are storing the database password in AWS Secrets Manager and storing the non-sensitive configuration parameter in AWS Systems Manager Parameter Store. Secrets Manager provides built-in rotation capabilities, which meets the security requirement, while Parameter Store is a cost-effective solution for non-sensitive data.

Adım Adım Çözüm

1
Evaluate the sensitivity and lifecycle requirements of the database password.
The password is a sensitive credential requiring automatic rotation, which points to AWS Secrets Manager.
AWS Secrets Manager provides built-in rotation integration for databases.
2
Evaluate the sensitivity of the configuration parameter.
The parameter is non-sensitive configuration data, which points to AWS Systems Manager Parameter Store.
Parameter Store is more cost-effective for storing non-sensitive configuration parameters.

Anahtar Kavram

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store for storing CloudFormation parameters.
Soru 20Soru →

A developer is using an AWS CloudFormation template to deploy an application that includes an Amazon S3 bucket. The S3 bucket contains critical application logs that must be preserved. The developer wants to ensure that the S3 bucket is not deleted when the CloudFormation stack is deleted.

Which action should the developer take to meet this requirement?

Cevabı ve açıklamayı göster

Cevap: Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.

Cevap

Set the DeletionPolicy attribute to Retain on the S3 bucket resource in the CloudFormation template.
The DeletionPolicy attribute in AWS CloudFormation enables you to preserve or back up a resource when its stack is deleted. Setting this policy to Retain on the S3 bucket resource ensures the bucket remains active and intact in the AWS account even after the parent stack is deleted.

Adım Adım Çözüm

1
Identify the target resource (the Amazon S3 bucket) that needs to be preserved.
The target resource is defined in the CloudFormation template.
You must modify the resource's configuration directly in the template definition.
2
Add the DeletionPolicy attribute to the S3 bucket resource block.
The DeletionPolicy attribute is set to Retain.
The Retain policy instructs AWS CloudFormation to keep the resource without deleting it when the stack is deleted.
3
Deploy the updated CloudFormation template.
The stack is updated with the resource retention policy in place.
This ensures that subsequent stack deletion operations will preserve the S3 bucket.

Anahtar Kavram

AWS CloudFormation DeletionPolicy
Tahmini Süre:45s
Sayfa 1 / 3Sonraki