Examkin

Soru

Zorluk: OrtaAWS CloudFormation Stack and Drift Management

A SysOps Administrator deployed a security group using an AWS CloudFormation template. Later, a developer manually added an inbound rule for port 22 (SSH) to the security group using the Amazon EC2 Console. The Administrator runs drift detection on the stack and identifies that the security group status is DRIFTED. The Administrator wants to remediate the drift so that the security group configuration matches the CloudFormation template again, without replacing the resource.

Which action should the Administrator take to resolve the drift?

  1. A
    Create and execute a CloudFormation change set using the original template to automatically detect and overwrite the manual changes.
  2. Manually delete the port 22 inbound rule from the security group in the Amazon EC2 Console, and then run drift detection on the stack again.Cevap
  3. C
    Perform a stack update using the original CloudFormation template with no changes to force the security group back to the template's defined configuration.
  4. D
    Change the logical ID of the security group in the CloudFormation template and update the stack to force a recreation of the security group.

Cevap

Manually delete the port 22 inbound rule from the security group in the Amazon EC2 Console, and then run drift detection on the stack again.
To remediate resource drift back to the template's defined configuration without replacing the resource, the manual (out-of-band) changes must be reverted directly on the resource itself (e.g., deleting the rule in the EC2 Console). Once the resource is manually updated to match the template, running drift detection again will verify that the resource status has returned to IN_SYNC. AWS CloudFormation does not automatically revert or overwrite out-of-band resource modifications during a stack update if there are no changes to the template itself.

Adım Adım Çözüm

1
Identify the manual configuration changes that caused the drift status to be DRIFTED.
Confirming the exact property difference (inbound port 22 rule addition) between the expected template state and the actual state.
Before remediating, you must know what modifications were made out-of-band.
2
Log in to the Amazon EC2 Console, locate the drifted security group, and delete the manually added inbound rule for port 22.
The physical resource is returned to the state defined in the CloudFormation template.
CloudFormation does not automatically overwrite manual changes during updates without template modifications, so the resource must be reverted manually.
3
Return to the CloudFormation console and run drift detection on the stack again.
The stack status returns to IN_SYNC.
This confirms that the physical resource configuration now matches the template definition.

Anahtar Kavram

Drift remediation in AWS CloudFormation requires either manually reverting the out-of-band changes on the resource or updating the template to match the new state; running a stack update with an unchanged template will not resolve the drift.
Bu soruyu puanla

Konular

AWS CloudFormation Stack and Drift Management

Bu konudan daha fazla soru