AWS Certified DevOps Engineer – ProfessionalConfiguration Management and Infrastructure as CodeEasy
A global e-commerce company uses AWS CloudFormation StackSets to deploy foundational infrastructure (e.g., VPCs, IAM roles) across hundreds of AWS accounts in multiple regions. They need to update a critical security patch in an IAM role that is part of a StackSet. The update must be applied to all existing stack instances across all accounts and regions without manual intervention. Which CloudFormation StackSet operation should be used for this purpose?
- ADeleteStackInstances
- BDescribeStackSet
- CCreateStackInstances
- DUpdateStackSet
Show answer & explanationAnswer & explanation
Correct answer: D. UpdateStackSet
The `UpdateStackSet` operation is specifically designed to update the template, parameters, or policies of an existing StackSet, which then propagates these changes to all associated stack instances across target accounts and regions. This is the correct operation for applying a security patch to an IAM role managed by a StackSet.
Why the other options are wrong
- A. `DeleteStackInstances` removes stack instances from accounts/regions, not updates them.
- B. `DescribeStackSet` retrieves information about a StackSet, it doesn't perform any modification.
- C. `CreateStackInstances` adds new stack instances to new accounts/regions, not updates existing ones.
CloudFormation StackSets Update
The `UpdateStackSet` operation in AWS CloudFormation StackSets allows you to update the template, parameters, or stack policy of an existing StackSet. This operation then propagates these changes to all associated stack instances across the specified AWS accounts and regions.
- Applies changes to all existing stack instances.
- Can update template, parameters, or stack policy.
- Supports controlled rollouts and error handling.
- Crucial for maintaining consistent infrastructure across many accounts/regions.
Memory trick: To make changes, you 'Update' the StackSet template.