Examkin

Soru

Zorluk: ZorAWS CloudFormation Stack and Drift Management

An administrator is managing an infrastructure stack using AWS CloudFormation. The stack includes an AWS IAM role used for an application's execution and an Amazon S3 bucket. An operator accidentally deleted the IAM role manually from the IAM Console. Shortly after, a scheduled automated stack update is triggered, but it fails due to an unrelated configuration error in another resource. The stack attempts to roll back, but the rollback fails, placing the stack in the UPDATE_ROLLBACK_FAILED state because the IAM role cannot be found. Which of the following actions can the SysOps Administrator take to successfully resolve the UPDATE_ROLLBACK_FAILED state and return the stack to a stable configuration? (Select TWO.)

  1. Manually recreate the IAM role with the exact same name as defined in the CloudFormation stack template, then initiate the Continue Update Rollback operation.Cevap
  2. Initiate the Continue Update Rollback operation and specify the logical ID of the deleted IAM role in the list of resources to skip.Cevap
  3. C
    Run drift detection on the stack, select the drifted IAM role resource, and execute the resource import operation to automatically recreate the role.
  4. D
    Update the CloudFormation stack template to remove the IAM role reference, and perform a stack update with the ForceRollback parameter set to true.
  5. E
    Modify the IAM execution role policy to grant the iam:PassRole permission, then re-run the stack update command to bypass the rollback failure.

Cevap

To resolve the UPDATE_ROLLBACK_FAILED state, the administrator must either manually recreate the deleted IAM role with the same name before continuing the rollback, or perform a Continue Update Rollback operation and specify the logical ID of the IAM role in the resources to skip list.
The correct options involve resolving the rollback failure either by manually recreating the IAM role with the same physical name (which satisfies CloudFormation's lookups during rollback) or by using the Continue Update Rollback feature and explicitly skipping the missing IAM role resource. Both actions successfully bypass the rollback failure and return the stack to a stable state.

Adım Adım Çözüm

1
Analyze the stack status and events to identify the resource causing the rollback failure.
The resource is identified as the manually deleted IAM role.
Before acting, it is necessary to confirm which resource's absence is blocking the rollback.
2
Determine if the deleted resource has a custom name or an auto-generated physical ID.
The IAM role has a custom name that can be recreated.
Resources with user-defined names can be manually recreated to satisfy CloudFormation during rollback, whereas auto-generated physical IDs cannot.
3
Choose to either recreate the role or skip it during the rollback continuation.
Either the role is recreated with the same name, or it is specified in the ResourcesToSkip list.
These are the two supported methods in CloudFormation to bypass rollback blocks caused by missing resources.
4
Execute the Continue Update Rollback command or operation.
The stack transitions to UPDATE_ROLLBACK_COMPLETE.
This returns the stack to a stable state, allowing subsequent updates.

Anahtar Kavram

CloudFormation Continue Update Rollback and Skipping Resources
Bu soruyu puanla

Konular

AWS CloudFormation Stack and Drift Management

Bu konudan daha fazla soru