DOP-C02 · Question #127
A DevOps engineer has implemented a CI/CD pipeline to deploy an AWS CloudFormation template that provisions a web application. The web application consists of an Application Load Balancer (ALB), a tar
The correct answer is A. Use the cfn-signal helper script to signal success or failure to CloudFormation. Use the. To prevent failed deployments due to application installation issues in user data, the DevOps engineer should utilize the cfn-signal helper script in conjunction with the CreationPolicy attribute for the Auto Scaling group. This ensures CloudFormation waits for a successful signa
Question
A DevOps engineer has implemented a CI/CD pipeline to deploy an AWS CloudFormation template that provisions a web application. The web application consists of an Application Load Balancer (ALB), a target group, a launch template that uses an Amazon Linux 2 AMI, an Auto Scaling group of Amazon EC2 instances, a security group, and an Amazon RDS for MySQL database. The launch template includes user data that specifies a script to install and start the application. The initial deployment of the application was successful. The DevOps engineer made changes to update the version of the application with the user data. The CI/CD pipeline has deployed a new version of the template. However, the health checks on the ALB are now failing. The health checks have marked all targets as unhealthy. During investigation, the DevOps engineer notices that the CloudFormation stack has a status of UPDATE_COMPLETE. However, when the DevOps engineer connects to one of the EC2 instances and checks /var/log/messages, the DevOps engineer notices that the Apache web server failed to start successfully because of a configuration error. How can the DevOps engineer ensure that the CloudFormation deployment will fail if the user data fails to successfully finish running?
Options
- AUse the cfn-signal helper script to signal success or failure to CloudFormation. Use the
- BCreate an Amazon CloudWatch alarm for the UnhealthyHostCount metric. Include an appropriate
- CCreate a lifecycle hook on the Auto Scaling group by using the AWS::AutoScaling::LifecycleHook
- DUse the Amazon CloudWatch agent to stream the cloud-init logs. Create a subscription filter that
How the community answered
(24 responses)- A79% (19)
- B4% (1)
- C4% (1)
- D13% (3)
Why each option
To prevent failed deployments due to application installation issues in user data, the DevOps engineer should utilize the `cfn-signal` helper script in conjunction with the `CreationPolicy` attribute for the Auto Scaling group. This ensures CloudFormation waits for a successful signal from the instance before proceeding, enabling automatic rollback if the application setup fails.
Using `cfn-signal` with the `CreationPolicy` attribute for the Auto Scaling group tells CloudFormation to wait for a signal from the EC2 instances indicating successful completion of the user data script. If the application installation or startup fails, CloudFormation will not consider the resource creation complete and can initiate a rollback, ensuring deployment resilience.
Creating a CloudWatch alarm for `UnhealthyHostCount` is for post-deployment operational monitoring and alerting, not for preventing or rolling back failed deployments within the CloudFormation stack itself.
While Auto Scaling lifecycle hooks allow for custom actions during instance lifecycle events, `cfn-signal` and `CreationPolicy` are the direct CloudFormation-native mechanisms to ensure resource readiness and enable rollback for user data script failures.
Streaming `cloud-init` logs to CloudWatch Logs is valuable for debugging failed instances, but it does not automate deployment success validation or trigger stack rollbacks within CloudFormation upon failure.
Concept tested: CloudFormation deployment stability with cfn-signal and CreationPolicy
Source: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-waitcondition.html
Topics
Community Discussion
No community discussion yet for this question.