Examkin

Soru

Zorluk: Çok zorDeployment Strategies and Execution

A SysOps Administrator is using AWS CloudFormation to update a web application stack. The stack includes an Auto Scaling group (ASG) configured with an AutoScalingRollingUpdate update policy. The update template references a new AMI and a new IAM instance profile for the EC2 instances. During the deployment, the new instances fail to send a success signal to CloudFormation within the PauseTime period because of a misconfiguration in the UserData script. As a result, CloudFormation automatically transitions to the UPDATE_ROLLBACK_IN_PROGRESS state to revert the ASG to its previous launch template. However, the rollback process fails, and the stack status changes to UPDATE_ROLLBACK_FAILED. The error details indicate that CloudFormation is unauthorized to associate the previous IAM instance profile with the EC2 instances. Which action should the administrator take to successfully restore the stack to a stable state?

  1. Add the iam:PassRole permission for the previous instance profile role to the CloudFormation execution role policy, and then perform the Continue Update Rollback action.Cevap
  2. B
    Perform a standard stack update using the CloudFormation Console to remove the new IAM instance profile reference, and then force a new deployment.
  3. C
    Modify the trust relationship of the old IAM instance profile's role to allow the sts:AssumeRole action for the autoscaling.amazonaws.com service principal, and then retry the update.
  4. D
    Terminate all instances in the Auto Scaling group to trigger automatic replacement under the old configuration, and then update the stack with rollback configuration disabled.

Cevap

Add the iam:PassRole permission for the previous instance profile role to the CloudFormation execution role policy, and then perform the Continue Update Rollback action.
The correct action is to add the iam:PassRole permission for the original instance profile's role to the CloudFormation execution role, and then invoke the Continue Update Rollback operation. When a CloudFormation stack update fails and attempts to roll back to a previous state, CloudFormation must perform all operations in reverse. If the original stack used an IAM instance profile, CloudFormation requires the iam:PassRole permission for that original role to re-associate it with the reverted EC2 instances. If this permission is missing, the rollback fails, placing the stack in the UPDATE_ROLLBACK_FAILED state. Resolving the authorization issue and triggering the Continue Update Rollback operation allows the rollback to finish successfully, bringing the stack back to the stable UPDATE_ROLLBACK_COMPLETE state.

Adım Adım Çözüm

1
Analyze the stack status and error message.
The stack is confirmed to be in the UPDATE_ROLLBACK_FAILED state due to an authorization issue (Access Denied) when trying to associate the old IAM instance profile during the rollback phase.
Before choosing a remediation step, the administrator must determine the exact state of the stack and why the rollback operation was blocked.
2
Identify the missing IAM permission.
CloudFormation requires the 'iam:PassRole' permission for the original role used by the previous IAM instance profile to reassign it to the instances.
When reverting resources to a previous state, CloudFormation performs the actions on behalf of the user or role executing the stack update, necessitating appropriate permission coverage.
3
Update the CloudFormation execution role policy.
The policy is updated to explicitly allow the 'iam:PassRole' action on the target role ARN.
This clears the authorization block, allowing CloudFormation to proceed with the rollback actions.
4
Execute the Continue Update Rollback command.
CloudFormation resumes the rollback process and successfully moves the stack status to UPDATE_ROLLBACK_COMPLETE.
The 'continue-update-rollback' API is the only mechanism allowed to move a stack out of the UPDATE_ROLLBACK_FAILED state back to a stable configuration.

Anahtar Kavram

Handling CloudFormation Rollback Failures and PassRole Permissions
Bu soruyu puanla

Konular

Deployment Strategies and Execution

Bu konudan daha fazla soru