AWS Certified DevOps Engineer – ProfessionalConfiguration Management and Infrastructure as CodeEasy
A financial services company is migrating its legacy applications to AWS. They have strict regulatory requirements that mandate all infrastructure changes be fully auditable and reversible. They are adopting Infrastructure as Code (IaC) using AWS CloudFormation. To meet the auditability and reversibility requirements, which CloudFormation feature should they leverage for managing changes to their production environments?
- AImplement a custom script to periodically compare desired state with actual state and apply changes.
- BPerform updates by modifying resources directly through the AWS Management Console.
- CDirectly update the stack using the `aws cloudformation update-stack` command.
- DUtilize CloudFormation Change Sets to preview and execute proposed changes.
Show answer & explanationAnswer & explanation
Correct answer: D. Utilize CloudFormation Change Sets to preview and execute proposed changes.
CloudFormation Change Sets allow you to preview how proposed changes to your stack template will impact your running resources before you implement them. This provides an auditable record of the intended changes and allows for a review process, aligning with the requirements for auditability and reversibility.
Why the other options are wrong
- A. While a custom script can manage state, CloudFormation Change Sets are a native and more robust solution for controlled, auditable changes within the CloudFormation ecosystem.
- B. Manual changes via the console are not IaC, lack auditability, and are highly prone to human error, failing to meet the specified requirements.
- C. Direct stack updates do not provide a detailed preview of changes, making auditability and controlled reversibility more difficult without prior review.
CloudFormation Change Sets
A feature that allows you to preview how proposed changes to your CloudFormation stack template will impact your running resources before you implement them.
- Provides a preview of changes.
- Facilitates review and approval processes.
- Enhances auditability and control over infrastructure updates.
Memory trick: Change Sets are like a blueprint review before construction, ensuring everything is correct and approved.