An organization uses AWS CloudFormation to deploy and manage its web application infrastructure. A system administrator manually modifies the instance type of a production EC2 instance via the AWS Management Console to handle a temporary traffic spike. Later, when the DevOps team runs a CloudFormation stack update to deploy an unrelated security group change, the stack update fails and rolls back. Which of the following is the root cause of this update failure?
- AThe EC2 instance was encrypted using an AWS-managed KMS key, which restricts CloudFormation from executing updates once a manual console modification occurs.
- BThe manual update in the console triggered a Service Control Policy (SCP) that permanently blocked the CloudFormation service role from applying changes to the target account.
- The manual modification created configuration drift, causing CloudFormation to encounter a conflict when comparing the template's expected state with the actual state of the resource.Cevap
- DCloudFormation requires a Canary deployment strategy to reconcile manual changes, and the default rolling update strategy failed because it could not merge the manual update.
Cevap
The manual modification created configuration drift, causing CloudFormation to encounter a conflict when comparing the template's expected state with the actual state of the resource.
The correct answer identifies that manual changes to resources under CloudFormation management result in configuration drift. When an update is triggered, CloudFormation attempts to apply the stack changes based on the expected state. When the actual state differs, the update can fail or rollback.
Adım Adım Çözüm
Anahtar Kavram
Detecting and managing configuration drift in AWS CloudFormation managed resources.
Tahmini Süre:1m 0s