Deployment, Provisioning, and Automation

169 soru

Tüm türler169 Çoktan seçmeli87 Çoklu seçim68 Sıralama14

A SysOps administrator is configuring a blue/green deployment for a microservice hosted on Amazon ECS with AWS Fargate. The deployment pipeline uses AWS CodeDeploy. The administrator wants to route 10% of the production traffic to the new version of the microservice for a duration of 15 minutes before routing the remaining traffic. Additionally, if the new version displays elevated HTTP 5XX error rates during this test period, the deployment must automatically roll back. Which of the following configuration steps should the administrator perform to achieve this? (Select TWO.)

Geçerli olan tümünü seçin

Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group.

Create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group, and add it as a rollback trigger in the CodeDeploy deployment group.

Configure an in-place deployment policy on the Amazon ECS service using a minimum healthy percent of 10% and a maximum percent of 110%.

Select the CodeDeployDefault.ECSAllAtOnce deployment configuration and configure Amazon Route 53 weighted routing to manually split the traffic.

Configure a trust relationship that allows the ECS task execution role to assume the CodeDeploy service role, but omit the iam:PassRole permission from the CodeDeploy policy.

Cevabı ve açıklamayı göster

Cevap: Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group.; Create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group, and add it as a rollback trigger in the CodeDeploy deployment group.

Cevap

Specify the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration in the CodeDeploy deployment group, and create an Amazon CloudWatch alarm that monitors the HTTP 5XX metric of the replacement (green) target group and add it as a rollback trigger in the CodeDeploy deployment group.

To implement the required canary traffic shifting, the administrator must choose the predefined CodeDeploy deployment configuration for ECS that corresponds to shifting 10% of traffic for 15 minutes, which is CodeDeployDefault.ECSCanary10Percent15Minutes. To automate the rollback based on application errors, the administrator must configure a CloudWatch alarm targeting the green (replacement) target group's HTTP 5XX metrics and add that alarm as a rollback trigger to the CodeDeploy deployment group.

Adım Adım Çözüm

Select the appropriate canary deployment configuration in AWS CodeDeploy.

CodeDeployDefault.ECSCanary10Percent15Minutes is selected, which matches the required traffic shifting behavior (10% traffic shifted to the new task set, followed by the remaining 90% after 15 minutes).

This configuration directly automates the 10% canary traffic allocation for the specified 15-minute duration without requiring manual DNS or routing adjustments.

Configure a monitoring alarm for rollback triggers.

An Amazon CloudWatch alarm is created to track the HTTP 5XX error rate metric specifically for the green (replacement) target group under the Application Load Balancer.

Monitoring the green target group ensures that issues affecting only the new version of the service are detected.

Link the alarm to the CodeDeploy deployment group.

The CloudWatch alarm is designated as a rollback trigger in the CodeDeploy deployment group configuration.

This linkage enables CodeDeploy to automatically abort the deployment and shift 100% of the traffic back to the original (blue) task set if the alarm enters the ALARM state during the deployment process.

Anahtar Kavram

AWS CodeDeploy deployment configurations and rollback triggers for Amazon ECS blue/green deployments.

Soru 2Soru →

A SysOps Administrator initiates an update on an AWS CloudFormation stack. During the update, a resource creation fails. CloudFormation attempts to roll back the stack to its previous stable state, but the rollback process fails, leaving the stack in the UPDATE_ROLLBACK_FAILED state. Which of the following is a common cause for this rollback failure?

A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

The rollback was initiated automatically, but CloudFormation requires a manual rollback trigger to proceed from a failed update.

The update was performed using an in-place deployment strategy instead of a blue/green deployment strategy.

The user initiating the update lacks the iam:PassRole permission required to execute the rollback operation.

Cevabı ve açıklamayı göster

Cevap: A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

Cevap

A resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted.

The correct answer is that a resource in the stack was manually deleted or modified outside of CloudFormation before the rollback was attempted. When resources are modified or deleted out-of-band, the stack suffers from drift. During a rollback, CloudFormation attempts to return the resources to their previous configuration. If a resource no longer exists or is in an unexpected state, the rollback operation will fail, placing the stack in the UPDATE_ROLLBACK_FAILED state.

Adım Adım Çözüm

Analyze the stack status transitions.

The stack went from UPDATE_IN_PROGRESS to UPDATE_ROLLBACK_IN_PROGRESS and finally to UPDATE_ROLLBACK_FAILED.

Understanding the status flow helps pinpoint where the failure occurred.

Determine why CloudFormation would fail to revert a resource during a rollback.

If the resource state has drifted or if the resource was deleted manually outside of CloudFormation, CloudFormation's internal engine cannot reconcile the expected state.

Identifying the root cause of rollback failures is key to resolving stack update errors.

Anahtar Kavram

AWS CloudFormation Rollback Failures and Drift Management

Soru 3Soru →

A SysOps Administrator is using AWS CodeDeploy to deploy an update to an application running on a fleet of Amazon EC2 instances. The deployment must guarantee that at least $75\%$ of the instances are healthy and serving traffic at any given time during the deployment. If any instance fails the update, the deployment must automatically revert to the previous working version.

Which configuration will meet these requirements?

Create a custom deployment configuration with the minimum healthy hosts set to

75\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Use the CodeDeployDefault.HalfAtATime predefined deployment configuration, and configure an Amazon CloudWatch alarm to trigger a rollback if any instance goes offline.

Create a custom deployment configuration with the minimum healthy hosts set to

25\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Deploy the application using an AWS CloudFormation stack update, and rely on the CloudFormation rollback execution role to automatically revert the CodeDeploy deployment if a failure is detected.

Cevabı ve açıklamayı göster

Cevap: Create a custom deployment configuration with the minimum healthy hosts set to $75\%$ using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Cevap

Create a custom deployment configuration with the minimum healthy hosts set to

75\%

using the percentage type, and configure the deployment group to roll back automatically when a deployment fails.

Creating a custom deployment configuration with the minimum healthy hosts set to

75\%

ensures that CodeDeploy updates at most

25\%

of the instances at a time, keeping at least

75\%

of the fleet healthy. Enabling the automatic rollback option on deployment failure in the deployment group ensures that CodeDeploy automatically reverts to the last known good version if any instance fails to deploy successfully.

Adım Adım Çözüm

Determine the required minimum healthy host threshold and create a custom CodeDeploy deployment configuration.

A custom configuration is created specifying minimum healthy hosts as

75\%

(percentage type).

Predefined configurations like HalfAtATime (

50\%

) or AllAtOnce (

0\%

) do not guarantee that at least

75\%

of the fleet remains online.

Configure the rollback behavior on the CodeDeploy deployment group.

The deployment group is updated to automatically roll back when a deployment failure occurs.

This fulfills the requirement to automatically revert to the previous working version upon failure without manual intervention.

Execute the deployment specifying the newly created custom deployment configuration.

The deployment runs, updating at most

25\%

of the instances at any time, and automatically rolls back if a failure is encountered.

This maintains the required application capacity and safety during the update process.

Anahtar Kavram

AWS CodeDeploy Deployment Configurations and Automatic Rollback Settings

Soru 4Soru →

A SysOps Administrator is using AWS CloudFormation to update a production application hosted on an Amazon EC2 Auto Scaling group behind an Application Load Balancer. The administrator is updating the launch template inside the CloudFormation template. The deployment must maintain full capacity at all times during the update to prevent performance degradation. Additionally, if the new instances fail application health checks during deployment, the stack must automatically roll back to its previous state.

Which two configurations should the administrator implement to meet these requirements? (Select two.)

Geçerli olan tümünü seçin

Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group.

Set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.

Set the MinInstancesInService parameter to

0

in the AutoScalingRollingUpdate policy to speed up the update process and minimize temporary EC2 running costs.

Monitor the CloudFormation console and manually transition the stack state from UPDATE_IN_PROGRESS to UPDATE_ROLLBACK_FAILED if the health checks fail.

Rely on the CloudFormation service role's default trust relationship to launch the instances, omitting the iam:PassRole permission from the IAM policy since the role has administrative access.

Cevabı ve açıklamayı göster

Cevap: Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group.; Set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.

Cevap

Configure the AutoScalingRollingUpdate policy's MinInstancesInService parameter to match the desired capacity of the Auto Scaling group, and set up CloudFormation rollback triggers in the RollbackConfiguration parameter to monitor CloudWatch alarms associated with the Application Load Balancer target group's health.

To maintain full capacity during a rolling update, the AutoScalingRollingUpdate policy's MinInstancesInService parameter must equal the desired capacity. This forces CloudFormation to launch new instances before terminating old ones. To automate rollback based on health checks, CloudFormation rollback triggers (RollbackConfiguration) must monitor CloudWatch alarms. If the alarms are triggered due to unhealthy instances, CloudFormation automatically rolls back the stack.

Adım Adım Çözüm

Configure the AutoScalingRollingUpdate policy on the Auto Scaling group in the CloudFormation template.

The MinInstancesInService parameter matches the desired capacity of the group.

This guarantees that CloudFormation launches new instances first before terminating any old instances, maintaining

100\%

capacity during the update.

Create CloudWatch alarms that monitor the Application Load Balancer target group's health metrics.

A configured alarm transitions into the ALARM state if the new deployment fails application-level health checks.

CloudWatch alarms are required to detect operational failures during the deployment process.

Associate the CloudWatch alarms with the CloudFormation stack's RollbackConfiguration triggers.

Automated monitoring of the alarms during and for a specified time after the stack update.

If any alarm breaches, CloudFormation detects it via the rollback triggers and automatically rolls back the stack to the last stable state.

Anahtar Kavram

Using CloudFormation AutoScalingRollingUpdate policies to preserve capacity combined with RollbackConfiguration to automate rollback on health check failure.

Tahmini Süre:2m 0s

Soru 5Soru →

A SysOps Administrator is configuring a blue/green deployment strategy for a containerized application running on Amazon Elastic Container Service (Amazon ECS) behind an Application Load Balancer (ALB). The updates must be deployed using AWS CodeDeploy. The administrator needs to ensure that the deployment automatically rolls back if the new tasks fail to launch or fail target group health checks, or if application performance degradation (such as elevated error rates) occurs during traffic shifting. Which two configuration steps must the administrator perform to meet these requirements? (Choose two.)

Geçerli olan tümünü seçin

Update the ECS service definition to set the deployment controller type to CodeDeploy, and associate the deployment group with two target groups: one for the active traffic environment and one for the standby environment.

Create Amazon CloudWatch alarms that monitor application metrics, and add these alarms to the CodeDeploy deployment group's automatic rollback configuration.

Enable the ECS deployment circuit breaker with the rollback option enabled within the ECS service definition.

Configure an Amazon EventBridge rule that detects a CodeDeploy deployment failure event and triggers an AWS Systems Manager (SSM) Automation workflow to redeploy the previous task definition.

Attach an IAM policy to the CodeDeploy service role that permits the sts:AssumeRole action but excludes the iam:PassRole permission for the ECS task execution role.

Cevabı ve açıklamayı göster

Cevap: Update the ECS service definition to set the deployment controller type to CodeDeploy, and associate the deployment group with two target groups: one for the active traffic environment and one for the standby environment.; Create Amazon CloudWatch alarms that monitor application metrics, and add these alarms to the CodeDeploy deployment group's automatic rollback configuration.

Cevap

To configure the blue/green deployment for Amazon ECS using AWS CodeDeploy with automatic rollback capabilities, the administrator must configure the ECS service deployment controller type to CodeDeploy, associate the deployment group with blue and green target groups, and configure Amazon CloudWatch alarms to trigger automatic rollbacks in the CodeDeploy deployment group.

The correct options specify configuring the ECS service to use the CodeDeploy deployment controller with two target groups (blue and green) to enable the blue/green deployment pattern, and configuring CloudWatch alarms in the CodeDeploy deployment group's automatic rollback settings to monitor metrics during deployment and trigger a rollback if needed.

Adım Adım Çözüm

Configure the deployment controller on the ECS service definition.

The ECS service is set to use the CodeDeploy deployment controller type instead of the default ECS rolling update controller.

This allows AWS CodeDeploy to manage the tasks, traffic shifting, and lifecycle hooks of the deployment.

Associate two target groups with the CodeDeploy deployment group.

CodeDeploy can direct traffic between the active target group (blue) and the target group running the new task version (green).

Two target groups are required in a blue/green deployment configuration to allow isolated testing and seamless traffic shifting.

Add CloudWatch alarms to the CodeDeploy rollback configuration.

If the metrics (like 5XX errors or response times) exceed limits, CodeDeploy detects the alarm and automatically reverts the traffic back to the original target group.

This meets the requirement to automatically roll back the deployment upon detecting application performance degradation.

Anahtar Kavram

AWS CodeDeploy manages ECS blue/green deployments by shifting traffic between two target groups and can automate rollbacks using native CloudWatch alarm integration.

Soru 6Soru →

A SysOps administrator is configuring an automated remediation workflow to enable Amazon S3 Block Public Access on any S3 bucket when a PutBucketPolicy API call is detected. The administrator creates an Amazon EventBridge rule that filters CloudTrail API events for PutBucketPolicy and targets the AWS Systems Manager Automation document AWS-ConfigureS3BucketPublicAccessBlock. The Automation document requires an execution role (AutomationAssumeRole) to perform the configuration changes. However, the execution fails to start when a policy changes.

Which of the following configuration steps must the SysOps administrator perform to successfully implement this automated remediation? (Select TWO.)

Geçerli olan tümünü seçin

Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document.

Grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.

Modify the trust relationship of the Systems Manager Automation execution role to allow the EventBridge service role to call sts:AssumeRole directly instead of passing the role.

Create a CloudWatch metric filter for PutBucketPolicy events and configure it to trigger the Systems Manager Automation document as a CloudWatch alarm action.

Enable detailed monitoring on the S3 buckets to reduce event delivery latency and trigger the EventBridge rule.

Cevabı ve açıklamayı göster

Cevap: Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document.; Grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.

Cevap

Configure the EventBridge target to use an IAM service role that contains ssm:StartAutomationExecution permissions for the target Systems Manager Automation document, and grant the EventBridge execution role iam:PassRole permissions for the Systems Manager Automation execution role.

To successfully execute automated remediation using Amazon EventBridge and AWS Systems Manager Automation, two authorization steps are necessary: first, the EventBridge rule must assume a role that permits starting the automation execution (ssm:StartAutomationExecution). Second, because Systems Manager must assume an execution role to perform the S3 bucket configuration change, the EventBridge role must be permitted to pass this execution role (iam:PassRole) to Systems Manager.

Adım Adım Çözüm

Ensure EventBridge is authorized to trigger the Systems Manager execution.

EventBridge target is associated with an IAM service role containing the ssm:StartAutomationExecution action for the AWS-ConfigureS3BucketPublicAccessBlock document.

By default, EventBridge does not have permissions to execute Systems Manager Automation documents unless explicitly granted via a service role.

Ensure the Systems Manager Automation execution role can be passed to the Systems Manager service.

The EventBridge target execution role has iam:PassRole permissions targeting the SSM Automation execution role (AutomationAssumeRole).

When a target service executes using a specified role, the calling service (EventBridge) must have permission to pass that role to the target service.

Anahtar Kavram

Configuring correct IAM permissions and service integration targets for event-driven Systems Manager Automation via Amazon EventBridge.

Soru 7Soru →

A SysOps administrator uses AWS CloudFormation to manage a production stack that includes an Amazon EC2 Auto Scaling group (ASG) behind an Application Load Balancer. The administrator attempts to update the application by modifying the CloudFormation template to use a new launch template. The new launch template specifies a new IAM instance profile with a new IAM role. The CloudFormation stack update is initiated using a dedicated IAM execution role.

During the deployment, the update fails on the ASG resource, causing CloudFormation to transition the stack to the UPDATE_ROLLBACK_IN_PROGRESS state. Shortly after, the stack status changes to UPDATE_ROLLBACK_FAILED. The CloudFormation event log shows an access denied error stating that CloudFormation is not authorized to associate the old IAM instance profile's role with the ASG's launch template.

How should the administrator resolve this issue to allow the rollback to complete successfully?

Modify the trust policy of the original IAM role to allow the autoscaling.amazonaws.com service principal to assume the role, and then initiate an UpdateStack API call with the previous template version.

Manually delete the resources that failed to roll back, update the administrator's IAM user policy to include sts:AssumeRole for the Auto Scaling service role, and then recreate the stack from the previous template.

Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.

Temporarily detach the Application Load Balancer from the Auto Scaling group to halt traffic, perform a manual in-place deployment of the previous application version to the instances, and then delete the failed CloudFormation stack.

Cevabı ve açıklamayı göster

Cevap: Update the IAM policy attached to the CloudFormation execution role to include the iam:PassRole permission for the original IAM role used in the previous launch template, and then execute the ContinueUpdateRollback action on the stack.

Cevap

The correct solution is to update the CloudFormation execution role's IAM policy to grant the iam:PassRole permission for the original role, and then run ContinueUpdateRollback. This is because CloudFormation needs explicit permission to pass the original role to the Auto Scaling group when rolling back the launch template. When a stack is in the UPDATE_ROLLBACK_FAILED state, the ContinueUpdateRollback action is the standard AWS mechanism to resume the rollback process after the block is resolved.

Adım Adım Çözüm

Analyze the CloudFormation event log error details.

Identify that the failure is due to an Access Denied error when CloudFormation attempts to associate the previous launch template's IAM role with the Auto Scaling Group.

To determine the exact permission or resource constraint causing the rollback failure.

Identify the missing IAM permission required for the rollback.

Determine that the CloudFormation execution role requires the iam:PassRole permission for the original IAM role, because CloudFormation is passing that role back to the Auto Scaling Group.

When reverting a resource that uses an IAM role to its previous state, the execution entity must be authorized to pass the original role, not just the newly proposed role.

Update the IAM policy of the CloudFormation execution role.

Add the iam:PassRole permission for the Amazon Resource Name (ARN) of the original IAM role.

To authorize CloudFormation to perform the role assignment required for the rollback.

Execute the ContinueUpdateRollback command on the CloudFormation stack.

CloudFormation resumes the rollback process, successfully configures the ASG back to the previous launch template, and transitions the stack to UPDATE_ROLLBACK_COMPLETE.

A stack in the UPDATE_ROLLBACK_FAILED state must be explicitly instructed to resume rolling back using the ContinueUpdateRollback operation once the blocking issue is resolved.

Anahtar Kavram

Troubleshooting CloudFormation stack updates and rollbacks involving IAM PassRole permissions

Soru 8Soru →

An organization has a fleet of Ubuntu Amazon EC2 instances. A SysOps Administrator creates a custom patch baseline in AWS Systems Manager Patch Manager to control which security updates are installed. The administrator registers a patch group named 'ubuntu-prod' with this custom baseline. During a scheduled maintenance window, the administrator observes that the instances are being patched, but they are receiving updates from the default AWS-provided patch baseline rather than the custom baseline.

Which of the following is the most likely cause of this behavior?

The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.

The custom patch baseline has not been set as the default patch baseline for the Ubuntu operating system in Systems Manager Patch Manager.

The IAM role used by the Maintenance Window to run the patch task is missing the 'iam:PassRole' permission.

The EC2 instances do not have the 'AmazonSSMManagedInstanceCore' policy attached to their IAM instance profile.

Cevabı ve açıklamayı göster

Cevap: The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.

Cevap

The EC2 instances are tagged with the key 'PatchGroup' and the value 'ubuntu-prod'.

For AWS Systems Manager Patch Manager to associate an instance with a patch group, the instance must have a tag with the exact case-sensitive key 'Patch Group' (with a space). If the tag key is 'PatchGroup' (without a space), Systems Manager fails to map the instance to the 'ubuntu-prod' patch group, causing Patch Manager to apply the default AWS-provided patch baseline instead.

Adım Adım Çözüm

Analyze the observed behavior where instances are successfully patched but are using the default baseline instead of the custom baseline.

This indicates that the Systems Manager agent is functioning and the maintenance window is executing, but the instances are not being associated with the registered patch group 'ubuntu-prod'.

When an instance is not successfully matched to a patch group, Systems Manager Patch Manager falls back to the default baseline for that operating system.

Verify the requirements for defining and matching patch groups on EC2 instances.

AWS Systems Manager requires managed nodes to be tagged with the exact case-sensitive key 'Patch Group' (with a space) and the value matching the registered patch group name.

Any deviation in the tag key, such as using 'PatchGroup' or 'patch_group', will cause the baseline mapping to fail.

Anahtar Kavram

AWS Systems Manager Patch Group Tagging Requirements

Soru 9Soru →

A SysOps Administrator is setting up a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must shift 10% of the traffic to the new version initially, wait 10 minutes, and then route the remaining 90% of the traffic to the new version. If the new version fails any health checks or triggers standard error rate alarms during the test period, the deployment must automatically roll back. Which TWO configuration steps should the administrator take to meet these requirements?

Geçerli olan tümünü seçin

Select the CodeDeployDefault.ECSCanary10Percent10Minutes deployment configuration in the deployment group settings.

Add CloudWatch alarms to the deployment group's rollback configuration to monitor for errors during the deployment.

Use an Application Load Balancer with dynamic listener rules to swap the target groups manually after 10 minutes.

Create a Route 53 weighted record set pointing to two different load balancers and configure Route 53 health checks to trigger rollbacks.

Grant the CodeDeploy deployment group the iam:AssumeRole permission for the ECS task execution role to pass the role to ECS.

Cevabı ve açıklamayı göster

Cevap: Select the CodeDeployDefault.ECSCanary10Percent10Minutes deployment configuration in the deployment group settings.; Add CloudWatch alarms to the deployment group's rollback configuration to monitor for errors during the deployment.

Cevap

The SysOps Administrator should select the CodeDeployDefault.ECSCanary10Percent10Minutes deployment configuration in the deployment group settings, and add CloudWatch alarms to the deployment group's rollback configuration to monitor for errors during the deployment.

The correct strategy uses AWS CodeDeploy's native ECS integration. The preconfigured setting shifts a small portion of traffic (10%) to the replacement task set for a brief trial period (10 minutes) before completing the shift to 100%. To implement automatic rollback, CloudWatch alarms must be attached to the deployment group. If the alarms trigger during the deployment, CodeDeploy will roll back to the original task set.

Adım Adım Çözüm

Configure AWS CodeDeploy deployment group traffic shifting behavior.

The traffic routing is defined as a canary shift where 10% of traffic goes to the replacement task set first.

To meet the exact traffic shifting requirements without custom script development.

Configure CloudWatch alarm tracking within the CodeDeploy deployment group.

The deployment group will monitor specified metrics such as target response times or error rates.

To trigger automatic rollbacks without manual intervention if metrics degrade during the 10-minute testing phase.

Anahtar Kavram

AWS CodeDeploy integration with Amazon ECS for automated canary deployments and rollbacks.

Soru 10Soru →

A SysOps Administrator is configuring automated monthly patching for a fleet of Amazon EC2 instances running Red Hat Enterprise Linux (RHEL). The administrator creates a custom patch baseline named RHEL-Critical-Baseline to approve only critical security updates. The target EC2 instances are tagged with the tag key Patch Group and the value RHEL-Production. The SSM Agent is running on all target instances, and an IAM instance profile with the AmazonSSMManagedInstanceCore policy is attached to all of them. The administrator then configures a Systems Manager State Manager association to run the AWS-RunPatchBaseline document on the instances tagged with Patch Group: RHEL-Production. During execution, the administrator observes that the instances are being patched, but they are receiving all updates from the default AWS-provided RHEL patch baseline rather than the custom RHEL-Critical-Baseline. Which action will resolve this issue?

Modify the State Manager association parameters to pass the custom baseline name RHEL-Critical-Baseline directly into the AWS-RunPatchBaseline document.

Configure an IAM policy for the EC2 instances' instance profile that includes iam:PassRole permissions for the custom patch baseline ARN.

Update the VPC route table associated with the private subnets hosting the instances to add a route to the local internet gateway (IGW) for SSM endpoint communication.

Cevabı ve açıklamayı göster

Cevap: Register the RHEL-Production patch group with the RHEL-Critical-Baseline custom patch baseline.

Cevap

To apply a custom patch baseline, the associated patch group must be explicitly registered with it. If a patch group is not registered with any custom baseline, AWS Systems Manager Patch Manager automatically applies the default baseline for that operating system. Registering the RHEL-Production patch group with the RHEL-Critical-Baseline custom patch baseline ensures that instances in that patch group are evaluated against the custom baseline.

Adım Adım Çözüm

Inspect the managed nodes configuration and confirm that the target instances are successfully tagged with the Patch Group tag.

Confirming that the instances have Patch Group = RHEL-Production.

This confirms that Systems Manager can read the correct patch group metadata from the target nodes.

Verify if the patch group RHEL-Production has been registered to the custom patch baseline RHEL-Critical-Baseline in Patch Manager.

Identify that the patch group has not been registered to the custom baseline, causing Patch Manager to default to the AWS-provided default RHEL baseline.

By default, Patch Manager evaluates managed nodes against the default patch baseline unless their patch group is registered to a custom baseline.

Navigate to Systems Manager Patch Manager, select the RHEL-Critical-Baseline, and register the RHEL-Production patch group to it.

The association between the patch group and the custom patch baseline is established.

This registration overrides the default baseline behavior, ensuring the custom baseline is applied to all instances in this patch group during the next association run.

Anahtar Kavram

AWS Systems Manager Patch Groups and Baselines registration

Soru 11Soru →

A SysOps Administrator is setting up automated OS patching for a fleet of Amazon EC2 instances running Ubuntu 22.04 LTS. The organization requires a custom patch baseline that automatically approves security updates with a 'Critical' or 'Important' severity 10 days after release. Patching must occur during a weekly maintenance window, and target instances must be grouped dynamically. Arrange the steps in the correct chronological order to configure this automated patch management workflow, starting with the baseline configuration.

Öğeleri doğru sıraya koymak için sürükleyin

Cevabı ve açıklamayı göster

Cevap

To configure the automated patch management workflow: 1. Create a custom patch baseline for Ubuntu with the specified rules. 2. Tag the target EC2 instances with the case-sensitive tag key 'Patch Group'. 3. Associate the patch group with the custom patch baseline. 4. Create a Systems Manager Maintenance Window. 5. Register the target instances with the Maintenance Window. 6. Register the 'AWS-RunPatchBaseline' Run Command task with the Maintenance Window.

To automate patching with a custom baseline, the baseline must first be created with the required approval rules. Instances must then be tagged with the case-sensitive 'Patch Group' tag key to define the patch group. Next, the patch group is associated with the custom patch baseline. Then, a maintenance window is created to define the execution schedule. The target instances are registered with the maintenance window, and finally, the task executing the AWS-RunPatchBaseline document with the Install operation is registered to target those instances within the maintenance window.

Adım Adım Çözüm

Create the custom patch baseline with the specified OS, approval rules, and auto-approval delay.

A custom patch baseline is created but not yet applied to any instances.

You must define the patching rules (e.g., auto-approving Critical patches after 10 days) first before applying them.

Apply the 'Patch Group' tag key (case-sensitive) with a custom value (e.g., 'Prod-Ubuntu') to the target instances.

The target instances are logically grouped under the 'Prod-Ubuntu' patch group.

SSM Patch Manager uses the 'Patch Group' tag key to map instances to specific baselines.

Associate the patch group name with the custom patch baseline.

Instances tagged with the patch group are now bound to the custom patch baseline instead of the default one.

This association ensures SSM Patch Manager applies the custom rules to the correct group of instances.

Create a Systems Manager Maintenance Window specifying the schedule (e.g., weekly) and duration.

A maintenance window is established but has no targets or tasks associated with it.

The maintenance window provides the scheduling framework for running the patching task.

The Maintenance Window now has defined targets to run tasks against.

You must register targets to the window so the task knows which instances to execute on.

Register the 'AWS-RunPatchBaseline' Run Command task with the Maintenance Window, specifying the registered targets and the 'Install' operation.

The configuration is complete, and patching will execute automatically on the schedule.

The task definition links the actual patch execution command ('AWS-RunPatchBaseline') to the maintenance window schedule and registered targets.

Anahtar Kavram

AWS Systems Manager Patch Manager configuration workflow involving custom baselines, case-sensitive patch groups, and maintenance window scheduling.

Tahmini Süre:2m 30s

Soru 12Soru →

A SysOps Administrator is troubleshooting a failed stack update in AWS CloudFormation. The stack was created using a custom IAM service role named `CFNServiceRole` to restrict resource management permissions. During a recent update, a deployment error occurred, and the stack's status transitioned to `UPDATE_ROLLBACK_FAILED`. The administrator attempts to resume the rollback process using the AWS CLI, but receives an `AccessDenied` error when executing the command.

Which combination of actions is required to successfully resume and complete the rollback of the stack? (Select TWO.)

Geçerli olan tümünü seçin

Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `CFNServiceRole` ARN.

Run the `aws cloudformation continue-update-rollback` command specifying the stack name.

Attach an IAM policy to the administrator's IAM identity that grants the `sts:AssumeRole` permission for the `CFNServiceRole` ARN.

Modify the trust relationship policy of the `CFNServiceRole` to allow the administrator's IAM identity to assume the role.

Run the `aws cloudformation rollback-stack` command specifying the stack name.

Cevabı ve açıklamayı göster

Cevap: Attach an IAM policy to the administrator's IAM identity that grants the `iam:PassRole` permission for the `CFNServiceRole` ARN.; Run the `aws cloudformation continue-update-rollback` command specifying the stack name.

Cevap

To successfully resume and complete the rollback, the administrator must attach an IAM policy granting the `iam:PassRole` permission for the `CFNServiceRole` ARN to their own IAM identity, and then run the `aws cloudformation continue-update-rollback` command specifying the stack name.

The correct options are attaching an IAM policy with the `iam:PassRole` permission for the `CFNServiceRole` and running the `aws cloudformation continue-update-rollback` command. The `iam:PassRole` permission is required because CloudFormation uses the execution role to perform operations, and the user must be authorized to pass this role to the service. The `continue-update-rollback` command is the designated API action to resume a stack rollback that has entered the `UPDATE_ROLLBACK_FAILED` status.

Adım Adım Çözüm

Analyze the `AccessDenied` error during the rollback continuation attempt.

Identify that the CloudFormation stack utilizes a custom service role (`CFNServiceRole`) and the calling administrator identity lacks the privilege to pass this role to the CloudFormation service.

When a custom execution role is associated with a stack, any user performing operations on that stack must have permissions to pass that role.

Modify the administrator's IAM policy.

Attach a policy granting the `iam:PassRole` action targeting the ARN of `CFNServiceRole`.

This allows the administrator's identity to delegate the permissions of the service role to AWS CloudFormation for execution.

Invoke the rollback resume command.

Execute `aws cloudformation continue-update-rollback --stack-name <stack-name>`.

This command directs CloudFormation to attempt the rollback process again from the point where it failed, using the restored delegation permissions.

Anahtar Kavram

AWS CloudFormation Rollback Troubleshooting and IAM Service Roles

Soru 13Soru →

A SysOps Administrator runs drift detection on an AWS CloudFormation stack that manages a production environment. The drift detection report indicates that an Amazon RDS DB instance is in the DRIFTED state because a developer manually updated the DB instance class and changed the backup retention period directly in the Amazon RDS console.

Which two actions should the Administrator take to resolve this resource drift and bring the stack and the DB instance back into alignment?

Geçerli olan tümünü seçin

Modify the DB instance configuration directly in the Amazon RDS console to match the expected values defined in the CloudFormation template.

Update the CloudFormation template to match the current DB instance class and backup retention period, and then perform a stack update.

Delete the CloudFormation stack and use the resource import feature to create a new stack from the drifted RDS instance.

Execute the `aws cloudformation continue-update-rollback` command with the `--remediate-drift` parameter specified.

Attach an IAM policy to the CloudFormation execution role that grants the `iam:PassRole` permission for the RDS service role.

Cevabı ve açıklamayı göster

Cevap: Modify the DB instance configuration directly in the Amazon RDS console to match the expected values defined in the CloudFormation template.; Update the CloudFormation template to match the current DB instance class and backup retention period, and then perform a stack update.

Cevap

To resolve the resource drift, the Administrator can either revert the manual changes directly in the Amazon RDS console to match the expected template values, or update the CloudFormation template to reflect the new resource properties and perform a stack update.

The correct actions to remediate resource drift are either to modify the actual resource configuration (reverting manual changes) to match the CloudFormation template's expected state, or to modify the CloudFormation template to match the current actual state of the resource and run a stack update.

Adım Adım Çözüm

Review the drift detection report to identify the drifted resources and their specific configuration changes.

The DB instance is found to have a different instance class and backup retention period compared to the expected template.

This determines the exact deviations that must be corrected to restore stack alignment.

Decide whether to revert the changes or accept them as the new baseline configuration.

Determined the appropriate path for drift resolution.

Allows selecting the correct remediation strategy based on business requirements.

Execute the chosen remediation strategy: either manually update the RDS instance in the console to match the template, or update the template and perform a CloudFormation stack update.

The drift is resolved, and the stack's status returns to IN_SYNC.

Synchronizes the stack definition and physical resources.

Anahtar Kavram

CloudFormation resource drift remediation

Soru 14Soru →

A SysOps Administrator is setting up automated patching for a fleet of Windows Server EC2 instances using AWS Systems Manager Patch Manager. The instances are divided into 'Staging' and 'Production' environments, and each group must be patched on different schedules using Systems Manager Maintenance Windows. The administrator has created two custom patch baselines. Which combination of steps is required to successfully implement this configuration? (Select TWO.)

Geçerli olan tümünü seçin

Tag the EC2 instances with the case-sensitive key 'Patch Group' and a value representing their environment, and then associate the patch group names with the custom patch baselines in Systems Manager.

Configure an IAM policy for the administrator with the 'iam:PassRole' action allowed on the Maintenance Window service role to permit task registration and execution.

Tag the EC2 instances with the lowercase key 'patch_group' and a value representing their environment, and then map these keys to the custom patch baselines in Systems Manager.

Configure the trust relationship of the EC2 instance profiles to permit 'sts:AssumeRole' for the Systems Manager service role 'ssm.amazonaws.com'.

Create a resource-based policy on the custom patch baselines that grants execution permissions to the IAM role associated with the Maintenance Window.

Cevabı ve açıklamayı göster

Cevap: Tag the EC2 instances with the case-sensitive key 'Patch Group' and a value representing their environment, and then associate the patch group names with the custom patch baselines in Systems Manager.; Configure an IAM policy for the administrator with the 'iam:PassRole' action allowed on the Maintenance Window service role to permit task registration and execution.

Cevap

To successfully implement this configuration, the administrator must tag the EC2 instances with the case-sensitive key 'Patch Group' and a value representing their environment, and configure an IAM policy for the administrator with the 'iam:PassRole' action allowed on the Maintenance Window service role.

Applying the exact case-sensitive tag key 'Patch Group' to the instances allows Systems Manager to identify and map them to their registered custom patch baselines. Additionally, the administrator must possess the 'iam:PassRole' permission to successfully register the execution task with the Maintenance Window service role, which authorizes Systems Manager to run the patch document on the target instances.

Adım Adım Çözüm

Tag the target EC2 instances.

Apply the tag with Key='Patch Group' and Value='Staging' or Value='Production' to the respective instances.

Systems Manager Patch Manager requires the exact case-sensitive tag key 'Patch Group' to associate instances with patch groups.

Associate patch groups with patch baselines.

Register the 'Staging' and 'Production' patch groups with their corresponding custom patch baselines in the Systems Manager console.

This mapping ensures that the appropriate custom patch baseline is selected during the patching run.

Configure iam:PassRole permissions.

Ensure the administrator's IAM policy permits the 'iam:PassRole' action on the Maintenance Window service role.

This permission is necessary for the administrator to register the task in the Maintenance Window and allow Systems Manager to assume the role on their behalf.

Anahtar Kavram

AWS Systems Manager Patch Manager configuration requires mapping instances to baselines using the case-sensitive 'Patch Group' tag key, and registering Maintenance Window tasks requires iam:PassRole permissions.

Soru 15Soru →

A SysOps administrator wants to automatically remediate non-compliant Amazon S3 buckets that allow public read access using AWS Config. The administrator plans to use the AWS-ConfigureS3BucketPublicAccessBlock Systems Manager Automation document to perform the remediation. Which of the following configurations are required to set up this automated remediation? (Select TWO.)

Geçerli olan tümünü seçin

Configure a remediation action within the AWS Config rule that targets the AWS-ConfigureS3BucketPublicAccessBlock Systems Manager Automation document.

Specify an IAM service role (remediation role) that grants Systems Manager Automation permission to modify S3 bucket settings, and ensure the administrator has iam:PassRole permission for this role.

Create an Amazon EventBridge rule that directly invokes the Systems Manager Automation document when any S3 bucket is created, bypassing AWS Config evaluation.

Rely on the Systems Manager Automation document to automatically inherit the IAM permissions of the administrator configuring the rule, without specifying an execution role.

Enable detailed CloudWatch monitoring on the S3 buckets to reduce the latency of the AWS Config rule evaluation to 1 minute.

Cevabı ve açıklamayı göster

Cevap: Configure a remediation action within the AWS Config rule that targets the AWS-ConfigureS3BucketPublicAccessBlock Systems Manager Automation document.; Specify an IAM service role (remediation role) that grants Systems Manager Automation permission to modify S3 bucket settings, and ensure the administrator has iam:PassRole permission for this role.

Cevap

Configure a remediation action within the AWS Config rule targeting the Systems Manager Automation document, and specify an IAM service role with permissions to modify S3 settings along with the iam:PassRole permission for the configuring administrator.

Setting up automatic remediation in AWS Config requires linking the compliance rule to a remediation target, such as a Systems Manager Automation document. Because Systems Manager performs the modification on the resource, it must be granted permission through an IAM service role. Additionally, the administrator setting up this remediation must possess the iam:PassRole permission to pass the role to Systems Manager.

Adım Adım Çözüm

Associate the AWS Config rule with the Systems Manager Automation remediation target.

The AWS Config rule will automatically trigger the specified Systems Manager Automation document when a compliance change detects a public S3 bucket.

This establishes the event flow between the compliance check and the automated remediation.

Create and configure the IAM service role for Systems Manager.

An IAM role is established that allows Systems Manager to update the public access block configuration on the S3 buckets.

Systems Manager requires authorization to interact with and modify S3 bucket settings.

Ensure the administrator configuring the rule has iam:PassRole permissions.

The administrator can successfully assign the IAM service role to the remediation rule without authorization errors.

To prevent privilege escalation, AWS requires administrators to have the PassRole permission when associating execution roles with services.

Anahtar Kavram

Configuring automatic remediation for compliance violations in AWS Config using Systems Manager Automation and appropriate IAM service roles.

Soru 16Soru →

A company hosts a production web application on AWS Elastic Beanstalk using an Auto Scaling group behind an Application Load Balancer. A SysOps Administrator needs to deploy a critical application update. The deployment strategy must ensure zero downtime, deploy the update to brand new instances for clean isolation, and allow for a rapid rollback by terminating the new instances if the deployment fails. Furthermore, the administrator must avoid the overhead of managing a separate Elastic Beanstalk environment or performing a DNS CNAME swap. Which deployment policy should the SysOps Administrator select to meet these requirements?

Rolling deployment

Immutable deployment

All-at-once deployment

Blue/Green deployment

Cevabı ve açıklamayı göster

Cevap: Immutable deployment

Cevap

The correct deployment policy is an immutable deployment.

The immutable deployment strategy satisfies all the requirements. It creates a temporary Auto Scaling group to launch a full set of new instances running the new version within the same environment. Traffic is cut over only after health checks pass, ensuring zero downtime. If the deployment fails, the rollback is rapid and simple: Elastic Beanstalk terminates the temporary Auto Scaling group, leaving the original instances untouched.

Adım Adım Çözüm

Analyze the deployment constraints: zero downtime, deployment to new isolated instances, fast rollback by terminating new instances, and avoiding the creation of a separate environment.

Identified that rolling and all-at-once updates modify existing instances in-place, while blue/green requires a separate environment.

This filters out strategies that do not meet the isolation or environment management requirements.

Evaluate the capabilities of an immutable deployment in AWS Elastic Beanstalk.

An immutable deployment launches a temporary Auto Scaling group inside the same environment, deploys the new version to new instances, and serves traffic only after health checks pass.

This satisfies the isolation requirement within a single environment.

Assess the rollback speed and downtime behavior of the immutable policy.

If the deployment fails, the temporary Auto Scaling group is terminated immediately, restoring all traffic to the original instances without downtime.

This meets the rapid rollback and zero-downtime constraints.

Anahtar Kavram

AWS Elastic Beanstalk immutable deployments isolate application updates on new EC2 instances in a temporary Auto Scaling group within the same environment to ensure zero downtime and rapid rollback.

Soru 17Soru →

A SysOps Administrator needs to determine if any resources in an active AWS CloudFormation stack have been modified by manual changes that were made outside of CloudFormation.

Which of the following steps should the administrator perform to identify this configuration drift? (Select TWO.)

Geçerli olan tümünü seçin

Run drift detection on the stack using the AWS CloudFormation console or the AWS CLI.

Review the stack drift status details to compare the actual resource property values with the expected values defined in the template.

Configure AWS CloudFormation to automatically rollback the stack to undo any detected out-of-band modifications.

Update the CloudFormation execution role with the iam:PassRole permission to allow CloudFormation to auto-remediate the drift.

Initiate a stack rollback operation to force the resources to synchronize with the original template parameters.

Cevabı ve açıklamayı göster

Cevap: Run drift detection on the stack using the AWS CloudFormation console or the AWS CLI.; Review the stack drift status details to compare the actual resource property values with the expected values defined in the template.

Cevap

To identify configuration drift, run drift detection on the stack using either the CloudFormation console or AWS CLI, and then review the stack drift status details to compare the actual resource properties against the expected ones in the template.

Running drift detection and reviewing the drift status details are the correct steps. Drift detection compares the actual state of resources to the expected state defined in the stack template. The drift status details show the specific resource properties that have drifted.

Adım Adım Çözüm

Initiate drift detection on the target CloudFormation stack.

CloudFormation evaluates the current state of each resource in the stack against its expected state defined in the template.

This starts the detection process and determines the drift status of each resource.

Examine the drift status details.

The console or CLI output shows the drift status (e.g., DRIFTED or IN_SYNC) and highlights the specific properties that differ.

This allows the administrator to pinpoint which manual changes occurred outside of CloudFormation.

Anahtar Kavram

CloudFormation drift detection allows SysOps Administrators to identify resources that have been modified outside of CloudFormation management by comparing actual resource configurations against the template.

Soru 18Soru →

A SysOps Administrator needs to deploy an application update to an AWS Elastic Beanstalk environment. The update must be completed as quickly as possible, and the application can tolerate a brief period of downtime during the deployment. Which deployment policy should the administrator choose?

All at once

Immutable

Rolling

Rolling with additional batch

Cevabı ve açıklamayı göster

Cevap: All at once

Cevap

The All at once deployment policy is the correct choice because it deploys the new version to all instances at the same time, making it the fastest deployment option, despite causing service downtime.

The All at once deployment policy is the fastest deployment method in Elastic Beanstalk because it applies the update to all instances simultaneously. Since the application can tolerate downtime, this is the optimal choice to minimize deployment duration.

Adım Adım Çözüm

Analyze the deployment requirements.

The requirements are: minimize deployment time (fastest speed) and tolerate temporary downtime.

This establishes the constraints that will be used to evaluate the deployment policies.

Evaluate the Elastic Beanstalk deployment policies against the constraints.

The All at once policy updates all instances at the same time, resulting in service interruption but the fastest possible deployment. Other policies (Immutable, Rolling, Rolling with additional batch) focus on maintaining service availability, which increases deployment time.

Matching the policy characteristics with the stated requirements identifies the correct strategy.

Anahtar Kavram

AWS Elastic Beanstalk Deployment Policies

Tahmini Süre:45s

Soru 19Soru →

An AWS CloudFormation stack update fails, and the stack becomes stuck in the `UPDATE_ROLLBACK_FAILED` state because a Security Group resource cannot be deleted. Which of the following actions can a SysOps Administrator take to successfully complete the rollback of the stack? (Select TWO.)

Geçerli olan tümünü seçin

Manually resolve the dependency that prevents the Security Group from being deleted, then choose Continue update rollback in the AWS CloudFormation console.

Run the `continue-update-rollback` command using the AWS CLI and specify the logical ID of the Security Group in the resources to skip parameter.

Change the stack policy to allow all updates, then use the `aws cloudformation rollback-stack` command to force the rollback to complete.

Delete the stack template from the local workspace and deploy it as a new nested stack using the `aws cloudformation deploy` command.

Modify the stack's service role to grant the `iam:PassRole` permission to the Security Group, then run drift detection on the stack.

Cevabı ve açıklamayı göster

Cevap: Manually resolve the dependency that prevents the Security Group from being deleted, then choose Continue update rollback in the AWS CloudFormation console.; Run the `continue-update-rollback` command using the AWS CLI and specify the logical ID of the Security Group in the resources to skip parameter.

Cevap

To resolve the failed rollback, the administrator must either manually remove the dependency that blocks the Security Group from being deleted and then continue the rollback, or execute the continue-update-rollback action and specify the Security Group to be skipped.

The correct options describe the two supported methods for resolving a stack rollback failure in AWS CloudFormation. The administrator can manually resolve the dependency blocking the resource deletion (such as detaching the Security Group from an EC2 instance launched outside the stack) and then select the 'Continue update rollback' option. Alternatively, the administrator can bypass the blocker by using the AWS CLI `continue-update-rollback` command with the `--resources-to-skip` parameter to omit the blocked Security Group.

Adım Adım Çözüm

Inspect the CloudFormation stack events to find the resource causing the rollback failure.

Identify that the Security Group cannot be deleted, placing the stack in the UPDATE_ROLLBACK_FAILED state.

This determines which specific resource is blocking the stack rollback operation.

Choose whether to fix the dependency manually (e.g., disassociating the Security Group from any active network interfaces) or skip the resource during the rollback.

Decide on a path to either satisfy the deletion constraint or bypass it.

CloudFormation requires either the underlying issue to be resolved or explicit permission to skip the failed resource.

Trigger the 'Continue update rollback' process via the AWS Console or the AWS CLI.

The stack completes the rollback and returns to a stable UPDATE_ROLLBACK_COMPLETE or ROLLBACK_COMPLETE state.

This resumes the rollback operation and brings the stack back to a manageable state.

Anahtar Kavram

When an AWS CloudFormation stack enters the UPDATE_ROLLBACK_FAILED state, it cannot be updated or modified until the rollback is resolved. This state is resolved by using the Continue Update Rollback action, either after fixing the blocking dependency manually or by skipping the blocked resources.

Soru 20Soru →

A SysOps Administrator needs to verify whether a specific Amazon S3 bucket within a large AWS CloudFormation stack has undergone any manual configuration changes. To minimize execution time and resource overhead, the administrator wants to check only this specific resource rather than the entire stack. Which action should the administrator take to accomplish this?

Run drift detection specifically for the Amazon S3 bucket resource within the CloudFormation console or using the AWS CLI.

Apply a temporary stack policy that denies drift detection on all resources except the S3 bucket, then perform stack-level drift detection.

Modify the stack's execution role to deny PassRole permissions on all resources except the S3 bucket, then perform stack-level drift detection.

Enable CloudWatch detailed monitoring on the stack to filter and identify configuration changes for the S3 bucket.

Cevabı ve açıklamayı göster

Cevap: Run drift detection specifically for the Amazon S3 bucket resource within the CloudFormation console or using the AWS CLI.

Cevap

Run drift detection specifically for the Amazon S3 bucket resource within the CloudFormation console or using the AWS CLI.

The correct option is to run drift detection specifically for the S3 bucket resource. AWS CloudFormation supports detecting drift on specific resources rather than the entire stack. This can be done via the CloudFormation console under the stack's resources tab, or by executing the 'aws cloudformation detect-stack-resource-drift' CLI command. This targeted check reduces execution time and focuses solely on the resource of interest.

Adım Adım Çözüm

Identify the target resource (the Amazon S3 bucket) and its physical ID within the AWS CloudFormation stack.

The target resource is isolated for drift checking.

This avoids scanning all other resources in the stack, reducing overhead.

Initiate drift detection for the specific resource using the console or the CLI command 'aws cloudformation detect-stack-resource-drift'.

CloudFormation compares the current configuration of the S3 bucket with its expected template configuration.

This provides a targeted drift status (e.g., IN_SYNC or MODIFIED) for only the selected resource.

Anahtar Kavram

CloudFormation Individual Resource Drift Detection

Tahmini Süre:45s

Sayfa 1 / 9Sonraki

Deployment, Provisioning, and Automation

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram