AWS Certified DevOps Engineer – ProfessionalConfiguration Management and Infrastructure as CodeEasy
A global e-commerce company uses AWS CloudFormation StackSets to deploy foundational infrastructure (e.g., VPCs, IAM roles) across hundreds of AWS accounts and multiple AWS Regions. The security team recently updated an IAM policy that needs to be reflected in all existing StackSet instances. The company requires a way to update these StackSet instances without causing downtime to the production applications running in those accounts. Which approach should the DevOps team take?
- AUse AWS CodeDeploy to deploy the updated IAM policy to each individual account.
- BCreate a new StackSet with the updated IAM policy and migrate resources from the old StackSet to the new one.
- CPerform an in-place update of the StackSet by updating the StackSet template with the new IAM policy.
- DDelete the existing StackSet and recreate it with the updated IAM policy.
Show answer & explanationAnswer & explanation
Correct answer: C. Perform an in-place update of the StackSet by updating the StackSet template with the new IAM policy.
CloudFormation StackSets are designed to manage infrastructure across multiple accounts and Regions. Updating the StackSet template with the new IAM policy and then performing an update operation on the StackSet will propagate the changes to all existing stack instances, typically without causing downtime for resource types like IAM policies.
Why the other options are wrong
- A. AWS CodeDeploy is for deploying application code, not for managing CloudFormation StackSet updates across accounts and Regions, and would require significant custom scripting.
- B. Creating a new StackSet and migrating resources is complex, time-consuming, and prone to errors, especially for foundational infrastructure like IAM roles, and would likely cause downtime.
- D. Deleting and recreating the StackSet would cause significant downtime and potential data loss, which is unacceptable for production.
CloudFormation StackSets Update
The process of modifying the template or parameters of an existing AWS CloudFormation StackSet to propagate changes to all its deployed stack instances across multiple accounts and Regions.
- Updates existing stack instances.
- Maintains consistency across accounts/Regions.
- Can be controlled with deployment preferences.
- Typically an in-place update of resources.
Memory trick: To keep 'StackSets' fresh, just 'Update' the 'Template' across 'Regions'.