SAP-C02 · Question #309
A large financial company is deploying applications that consist of Amazon EC2 and Amazon RDS instances to the AWS Cloud using AWS CloudFormation. The CloudFormation stack has the following stack…
The correct answer is C. Add a second statement that specifies "Effect": "Deny", "Action":["Update:Delete". Prevent replacement updates for an instance The following policy denies updates that would cause a replacement of the instance with the MyInstance logical ID. It allows all update actions on all other stack resources with an Allow statement. The Allow statement doesn't apply to…
Question
A large financial company is deploying applications that consist of Amazon EC2 and Amazon RDS instances to the AWS Cloud using AWS CloudFormation. The CloudFormation stack has the following stack policy:
The company wants to ensure that developers do not lose data by accidentally removing or replacing RDS instances when updating the CloudFormation stack. Developers also still need to be able to modify or remove EC2 instances as needed. How should the company change the stack policy to meet these requirements?
Options
- AModify the statement to specify "Effect": "Deny", "Action":["Update:*"] for all logical RDS
- BModify the statement to specify "Effect": "Deny", "Action":["Update:Delete"] for all logical RDS
- CAdd a second statement that specifies "Effect": "Deny", "Action":["Update:Delete",
- DAdd a second statement that specifies "Effect": "Deny", "Action":["Update:*"] for all logical RDS
How the community answered
(33 responses)- A15% (5)
- B6% (2)
- C76% (25)
- D3% (1)
Explanation
Prevent replacement updates for an instance The following policy denies updates that would cause a replacement of the instance with the MyInstance logical ID. It allows all update actions on all other stack resources with an Allow statement. The Allow statement doesn't apply to the MyInstance resource because the Deny statement always overrides allow actions. https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack- resources.html#protect-stack-resources-modifying
Community Discussion
No community discussion yet for this question.