Examkin

Soru

Zorluk: OrtaAWS CloudFormation Stack and Drift Management

An administrator is troubleshooting a failed stack update in AWS CloudFormation. The stack has entered the UPDATE_ROLLBACK_FAILED state. The update failed due to a misconfiguration in an Amazon EC2 launch template, and the subsequent rollback failed because the IAM service role originally associated with the stack was accidentally deleted.

Which combination of actions must the administrator take to successfully roll back the stack to a stable state? (Select TWO.)

  1. Ensure the administrator's IAM identity is granted the iam:PassRole permission for the IAM service role to be used for the rollback.Cevap
  2. Execute the continue-update-rollback command, specifying the ARN of the IAM service role.Cevap
  3. C
    Modify the CloudFormation stack template to remove the misconfigured EC2 launch template, then execute the update-stack command.
  4. D
    Execute the rollback-stack command, specifying the --service-role parameter to force the rollback using a different role.
  5. E
    Add the sts:AssumeRole permission for the service role directly to the administrator's IAM policy to allow CloudFormation to execute.

Cevap

The administrator must ensure their IAM identity is granted the iam:PassRole permission for the service role and execute the continue-update-rollback command specifying the ARN of that service role.
The correct options are: granting the administrator the iam:PassRole permission and executing the continue-update-rollback command with the role ARN. When a service role associated with a stack is deleted, any attempt to roll back will fail because CloudFormation cannot assume the role. The administrator can resolve this by providing a new or recreated role during the continue-update-rollback command. To do this, the administrator's identity must possess the iam:PassRole permission for the new role so CloudFormation can assume it.

Adım Adım Çözüm

1
Verify and configure permissions for the administrator.
The administrator's IAM user or role is granted the iam:PassRole permission for the target IAM service role.
Before passing any IAM role to an AWS service like CloudFormation, the caller must have the iam:PassRole permission to ensure security delegation boundaries.
2
Ensure the target IAM service role exists with the required permissions.
A valid service role is available with the necessary policies to delete, update, or revert the EC2 launch template resources in the stack.
CloudFormation must assume this role to modify the physical resources in AWS during the rollback process.
3
Run the resume operation using the CLI or Console.
The rollback is resumed using the continue-update-rollback command, specifying the --role-arn parameter pointing to the valid service role.
Specifying the role ARN allows CloudFormation to use the new/recreated role instead of the deleted one to complete the rollback.

Anahtar Kavram

Remediating CloudFormation stacks in the UPDATE_ROLLBACK_FAILED state by specifying an alternative or recreated service role.
Bu soruyu puanla

Konular

AWS CloudFormation Stack and Drift Management

Bu konudan daha fazla soru