Examkin

Soru

Zorluk: OrtaAWS CloudFormation Stack and Drift Management

An environment is managed using an AWS CloudFormation stack. A SysOps administrator initiates a stack update to modify an Application Load Balancer and its associated security group. The update fails, and the subsequent rollback also fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. The stack events show that a security group rule cannot be deleted because it is referenced by another resource that was created manually outside the stack. Which action should the administrator take to successfully return the stack to a stable state?

  1. A
    Delete the CloudFormation stack to force-remove all resources, recreate the stack using the last known stable template, and then manually attach the new resources to the instances.
  2. B
    Modify the user's IAM policy to include the iam:PassRole permission for the CloudFormation service role, and then retry the stack update command with the rollback option disabled.
  3. Execute the ContinueUpdateRollback action while specifying the security group as a resource to skip, and then manually delete the external reference and update the security group configuration to match the template.Cevap
  4. D
    Perform a nested stack update that replaces the security group resource definition in the parent template, and configure the rollback policy to ignore resource deletion errors.

Cevap

Execute the ContinueUpdateRollback action while specifying the security group as a resource to skip, and then manually delete the external reference and update the security group configuration to match the template.
Executing the ContinueUpdateRollback action and specifying the blocked security group as a resource to skip allows CloudFormation to bypass the dependency block and roll back the remaining resources, bringing the stack to the UPDATE_ROLLBACK_COMPLETE state. The administrator must then manually delete the external dependency and configure the security group to match the template to resolve the configuration drift.

Adım Adım Çözüm

1
Analyze the CloudFormation stack events to find the resource causing the rollback failure.
Identify that the security group fails to roll back due to an external dependency created outside the stack.
This determines why the rollback is blocked and helps choose the correct remediation path.
2
Call the ContinueUpdateRollback API or use the console to continue the rollback, specifying the blocked security group in the resources to skip.
The stack successfully rolls back all other resources and transitions to the UPDATE_ROLLBACK_COMPLETE state.
Skipping the blocked resource allows CloudFormation to bypass the error and return the rest of the stack to a stable state.
3
Manually delete the external reference to the security group, and update its configuration to match the template.
The manually modified security group is synchronized with the template, correcting the resource drift.
Skipped resources are left out-of-sync with the stack template and must be manually aligned to resolve configuration drift.

Anahtar Kavram

Handling CloudFormation update rollback failures by skipping blocked resources and manually reconciling drift.
Bu soruyu puanla

Konular

AWS CloudFormation Stack and Drift Management

Bu konudan daha fazla soru