Answer-first summary for fast verification
Answer: Use a CloudFormation stack policy with an explicit allow for all resources and an explicit deny of protected resources with Update:*.
CloudFormation stack policies allow protecting specific resources from updates by denying Update:* on them while allowing on others. This prevents accidental changes to DB during stack updates without affecting deployments.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
A user accidentally changed a database property in a CloudFormation template and caused an application interruption. How can the DevOps team continue deploying while preventing modifications to specific resources?
A
Set up an AWS Config rule to alert on CloudFormation changes; use Lambda to cancel operations affecting protected resources.
B
Set up an EventBridge rule for any CloudFormation API call; use Lambda to cancel if protected resources were modified.
C
Use a CloudFormation stack policy with an explicit allow for all resources and an explicit deny of protected resources with Update:*.
D
Attach an IAM policy to the DevOps team role preventing stack updates based on protected resource ARNs.
No comments yet.