SOA-C02 Question 133
Single answerYou are managing an AWS CloudFormation stack that provisions resources for a production application. After updating the stack to add additional resources, the update operation fails due to a misconfigured IAM role. You notice that some resources were successfully created, but others were not. What is the BEST next step to ensure the stack is in a consistent state?
- A
Manually delete the resources that were created during the failed update and retry the stack update.
- B
Use the 'Rollback Stack' operation in AWS CloudFormation to revert the stack to its previous state.
- C
Update the failed resources manually in the AWS Management Console and mark the stack update as complete.
- D
Fix the IAM role configuration and retry the stack update using the 'Continue Update Rollback' operation.
Show answer and explanation
Correct answer: D
Explanation
When a CloudFormation stack update fails, the stack enters a 'ROLLBACK_IN_PROGRESS' or 'UPDATE_ROLLBACK_FAILED' state if the rollback also encounters issues. To recover from this situation, you should use the 'Continue Update Rollback' operation to retry the rollback after fixing the underlying issue. This ensures the stack is returned to its previous state without manual intervention, maintaining consistency and following best practices.
- A. Incorrect.
Manually deleting resources is not recommended because it can lead to inconsistencies in the stack and requires manual intervention, which increases the risk of errors.
- B. Incorrect.
CloudFormation automatically attempts to roll back the stack to its previous state when an update fails. However, if the rollback itself fails or the stack is already in a failed state, this option may not be available.
- C. Incorrect.
Manually updating resources outside of CloudFormation can lead to drift between the stack definition and the actual resources in the account. Additionally, there is no way to mark a failed update as complete manually.
- D. Correct.
The 'Continue Update Rollback' operation is the correct way to handle a failed stack update. It allows you to fix the underlying issue (in this case, the misconfigured IAM role) and retry the rollback process to bring the stack back to a consistent state.