Examkin

Soru

Zorluk: KolayAWS CloudFormation Stack and Drift Management

A SysOps Administrator performs a drift detection operation on an AWS CloudFormation stack containing an Amazon EC2 instance and a Security Group. The drift detection report indicates that the stack is DRIFTED because a new inbound port was manually added to the Security Group. Which two methods can the administrator use to resolve the drift and align the stack's actual configuration with its expected template configuration? (Select TWO.)

  1. Manually remove the inbound port from the Security Group, then run drift detection on the stack again.Cevap
  2. Update the CloudFormation stack using a modified template that includes the new inbound port configuration.Cevap
  3. C
    Execute the AWS CLI command detect-stack-drift with the --remediate parameter to automatically revert the manual changes.
  4. D
    Apply a CloudFormation stack policy that blocks updates to the Security Group to trigger an automatic rollback to the template definition.
  5. E
    Configure the stack's IAM service role to grant iam:PassRole permissions, enabling the CloudFormation drift detection tool to rewrite the Security Group rules.

Cevap

Manually removing the inbound port from the Security Group and running drift detection again, or updating the CloudFormation stack using a modified template that includes the new inbound port configuration.
To resolve resource drift, a SysOps Administrator can either change the resource manually to match the expected template configuration, or update the template to match the actual resource configuration and perform a stack update. Manually removing the inbound port or updating the template to include the new port both bring the resource and template configurations back into alignment.

Adım Adım Çözüm

1
Analyze the drift detection report to identify the specific drifted property, which is the manually added inbound port on the Security Group.
The target state and current state differences are clearly understood.
This establishes what resource configuration must be corrected or aligned.
2
Decide on the remediation strategy: either revert the manual change out-of-band or update the CloudFormation template to match the current manual state.
Two valid paths identified: manually deleting the security group rule or updating the template with the new rule.
Both methods align the template and resource configurations to resolve drift.
3
Execute the chosen remediation action and run drift detection again to verify the stack status.
The stack drift status returns to IN_SYNC.
Drift detection must be run again to update the stack's recorded status.

Anahtar Kavram

Remediating resource drift in AWS CloudFormation by either reverting out-of-band changes manually or updating the stack template to match the actual configuration.
Bu soruyu puanla

Konular

AWS CloudFormation Stack and Drift Management

Bu konudan daha fazla soru