Examkin

Soru

Zorluk: Çok zorAutomating Deployment and Configuration Management

An enterprise manages its application infrastructure using AWS CloudFormation StackSets deployed across multiple member accounts in an AWS Organization. A developer manually modified the configuration of an Amazon EC2 instance and its associated security groups in a member account to troubleshoot a production issue. When the administrator runs a StackSet update to deploy a new version of the infrastructure, the update fails and rolls back in that specific member account because of this configuration drift. Additionally, the StackSet template must fetch and decrypt a database password stored in a central Amazon S3 bucket in the administrator account during deployment. Which combination of steps should the Solutions Architect take to resolve the update failure, automate configuration enforcement, and securely handle parameter decryption?

  1. A
    Run drift detection on the StackSet to identify the drifted resources, manually update the drifted configurations to match the template or import the changes, and then re-run the StackSet update. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use the default AWS-managed KMS key (aws/s3) in the administrator account to encrypt the password, and configure the key policy to allow the member accounts' execution roles to decrypt it.
  2. B
    Run drift detection on the StackSet to identify the drifted resources, manually update the drifted configurations to match the template or import the changes, and then re-run the StackSet update. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use a Customer Managed Key in the administrator account, and attach a Service Control Policy (SCP) to the member accounts' Organizational Unit that grants decrypt permissions for this key.
  3. Run drift detection on the StackSet to identify the drifted resources, manually update the drifted configurations to match the template or import the changes, and then re-run the StackSet update. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use a Customer Managed Key in the administrator account with a key policy that allows the member accounts' execution roles to decrypt the password.Cevap
  4. D
    Force the StackSet update using the override flag to automatically overwrite all out-of-band console changes and align them with the template. Implement AWS Systems Manager State Manager to continuously enforce the configuration. Use a Customer Managed Key in the administrator account with a key policy that allows the member accounts' execution roles to decrypt the password.

Cevap

The correct answer is the option that involves running drift detection, manually aligning configuration or importing changes to allow the stack update to succeed, using AWS Systems Manager State Manager for configuration enforcement, and configuring a Customer Managed Key (CMK) in the administrator account with cross-account access permissions in its key policy.
The correct answer correctly addresses all three aspects of the scenario. First, resolving configuration drift requires running drift detection and manually or programmatically updating the drifted configurations to match the template before retrying the update. Second, using AWS Systems Manager State Manager ensures ongoing configuration compliance. Third, cross-account access to encrypted parameters requires a Customer Managed Key (CMK) in the central account with a key policy explicitly granting cross-account decrypt permissions to the member account roles.

Adım Adım Çözüm

1
Detect and resolve the configuration drift in the member account.
The local drifted resources are aligned with the CloudFormation template state, preventing update conflicts.
Out-of-band modifications cause stack updates to fail or roll back due to property mismatches.
2
Implement AWS Systems Manager State Manager to enforce configurations.
The EC2 instances and security groups are regularly audited and brought back to the desired state automatically.
This automates configuration management and prevents future manual configuration drift.
3
Configure a Customer Managed Key (CMK) in the administrator account for the S3 bucket's data decryption.
The member accounts' execution roles can successfully assume permissions to decrypt the database password using the cross-account KMS key policy.
Only Customer Managed Keys support key policy modification to delegate cross-account decryption access, which is required here.

Anahtar Kavram

Configuration drift remediation in CloudFormation StackSets combined with secure cross-account KMS decryption and configuration enforcement.

Alternatif Yöntem

Instead of manual remediation before the StackSet update, you can use AWS Config auto-remediation with Systems Manager Automation to dynamically align the drifted security group configuration, then execute the StackSet update.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Automating Deployment and Configuration Management