Examkin

Soru

Zorluk: OrtaAWS CloudFormation Stack and Drift Management

A company's SysOps administrator is updating an AWS CloudFormation stack that manages a three-tier web application. During the update, a failure occurs, and CloudFormation attempts to roll back the stack. However, the rollback also fails, leaving the stack in the `UPDATE_ROLLBACK_FAILED` state. Investigations show that the CloudFormation service role (`RoleARN`) is missing the permissions required to delete an Amazon S3 bucket that was created during the failed update. Which combination of actions will allow the administrator to successfully return the stack to a stable state? (Select TWO.)

  1. Update the CloudFormation service role's IAM policy to grant the necessary permissions, or specify a different IAM role with sufficient permissions.Cevap
  2. Execute the Continue Update Rollback operation from the AWS CloudFormation console or by using the AWS CLI.Cevap
  3. C
    Run the `aws cloudformation rollback-stack` command with the `--force` flag using the administrator's personal credentials.
  4. D
    Delete the stack directly, selecting the option to retain the S3 bucket, and then redeploy the template.
  5. E
    Add the `sts:AssumeRole` permission to the administrator's IAM user policy to allow direct modification of the stack's resources.

Cevap

Updating the CloudFormation service role's IAM policy or specifying a different role with sufficient permissions, and then executing the Continue Update Rollback operation from the console or CLI.
To recover from a stack in the UPDATE_ROLLBACK_FAILED state, the administrator must fix the underlying issue that blocked the rollback. In this case, updating the service role's policy or specifying a different role solves the permissions issue. Then, triggering the Continue Update Rollback operation tells CloudFormation to retry the rollback.

Adım Adım Çözüm

1
Analyze the stack events to identify the resource causing the rollback failure and the reason for the failure.
The S3 bucket deletion fails due to insufficient permissions in the service role.
Before remediating, the exact cause of the UPDATE_ROLLBACK_FAILED state must be determined.
2
Update the CloudFormation service role's policy to add the missing permissions, or prepare a different service role that has these permissions.
CloudFormation now has the necessary authority to delete the S3 bucket during rollback.
CloudFormation needs valid API permissions to perform delete operations on resources in the stack.
3
Trigger the Continue Update Rollback action via the console or run the `aws cloudformation continue-update-rollback` command.
The stack successfully continues rolling back and reaches the UPDATE_ROLLBACK_COMPLETE state.
This operation commands CloudFormation to retry the rollback process using the updated permissions.

Anahtar Kavram

AWS CloudFormation Stack and Drift Management
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

AWS CloudFormation Stack and Drift Management

Bu konudan daha fazla soru