SOA-C02 Question 136
Single answerYou are using AWS CloudFormation to deploy a stack, but the process fails in the middle of deployment due to an incorrect IAM policy. You need to troubleshoot and fix the issue while ensuring that no incomplete resources remain in your account. What is the best approach?
- A
Manually delete all the resources created by the failed stack deployment and update the IAM policy.
- B
Update the IAM policy and restart the same stack deployment without deleting the previous stack.
- C
Enable the rollback on failure option, update the IAM policy, and redeploy the stack.
- D
Use the AWS CloudFormation drift detection feature, update the IAM policy, and redeploy the stack.
Show answer and explanation
Correct answer: C
Explanation
When a CloudFormation deployment fails, enabling rollback on failure ensures that incomplete resources are automatically cleaned up, preventing resource conflicts or unnecessary charges. Once the IAM policy issue is resolved, the stack can be redeployed successfully. This method leverages CloudFormation's built-in features for error handling and cleanup, making it the most efficient and reliable approach.
- A. Incorrect.
Manually deleting resources is error-prone and not recommended. AWS CloudFormation can handle cleanup automatically if rollback is enabled.
- B. Incorrect.
Restarting the stack without deleting the previous one may result in resource conflicts and is not a reliable troubleshooting method.
- C. Correct.
Enabling rollback on failure ensures that any partially created resources are deleted when the stack fails. Once the IAM policy is corrected, the stack can be redeployed cleanly.
- D. Incorrect.
AWS CloudFormation drift detection is used to identify changes to resources outside of CloudFormation. It does not help with a failed stack deployment.