Examkin

Soru

Zorluk: ZorAWS CloudFormation Stack and Drift Management

A SysOps Administrator is troubleshooting a failed stack update in AWS CloudFormation. The stack was created using a custom IAM service role named `CFNServiceRole` to restrict resource management permissions. During a recent update, a deployment error occurred, and the stack's status transitioned to `UPDATE_ROLLBACK_FAILED`. The administrator attempts to resume the rollback process using the AWS CLI, but receives an `AccessDenied` error when executing the command.

Which combination of actions is required to successfully resume and complete the rollback of the stack? (Select TWO.)

  1. Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `CFNServiceRole` ARN.Cevap
  2. Run the `aws cloudformation continue-update-rollback` command specifying the stack name.Cevap
  3. C
    Attach an IAM policy to the administrator's IAM identity that grants the `sts:AssumeRole` permission for the `CFNServiceRole` ARN.
  4. D
    Modify the trust relationship policy of the `CFNServiceRole` to allow the administrator's IAM identity to assume the role.
  5. E
    Run the `aws cloudformation rollback-stack` command specifying the stack name.

Cevap

To successfully resume and complete the rollback, the administrator must attach an IAM policy granting the `iam:PassRole` permission for the `CFNServiceRole` ARN to their own IAM identity, and then run the `aws cloudformation continue-update-rollback` command specifying the stack name.
The correct options are attaching an IAM policy with the `iam:PassRole` permission for the `CFNServiceRole` and running the `aws cloudformation continue-update-rollback` command. The `iam:PassRole` permission is required because CloudFormation uses the execution role to perform operations, and the user must be authorized to pass this role to the service. The `continue-update-rollback` command is the designated API action to resume a stack rollback that has entered the `UPDATE_ROLLBACK_FAILED` status.

Adım Adım Çözüm

1
Analyze the `AccessDenied` error during the rollback continuation attempt.
Identify that the CloudFormation stack utilizes a custom service role (`CFNServiceRole`) and the calling administrator identity lacks the privilege to pass this role to the CloudFormation service.
When a custom execution role is associated with a stack, any user performing operations on that stack must have permissions to pass that role.
2
Modify the administrator's IAM policy.
Attach a policy granting the `iam:PassRole` action targeting the ARN of `CFNServiceRole`.
This allows the administrator's identity to delegate the permissions of the service role to AWS CloudFormation for execution.
3
Invoke the rollback resume command.
Execute `aws cloudformation continue-update-rollback --stack-name <stack-name>`.
This command directs CloudFormation to attempt the rollback process again from the point where it failed, using the restored delegation permissions.

Anahtar Kavram

AWS CloudFormation Rollback Troubleshooting and IAM Service Roles
Bu soruyu puanla

Konular

AWS CloudFormation Stack and Drift Management

Bu konudan daha fazla soru