AWS Certified DevOps Engineer – ProfessionalConfiguration Management and Infrastructure as CodeMedium
A global e-commerce company uses AWS CloudFormation StackSets to deploy foundational infrastructure (e.g., VPCs, IAM roles) across hundreds of AWS accounts and multiple AWS Regions. The security team has identified a critical vulnerability in a specific IAM policy attached to a role deployed by a StackSet. They need to update this IAM policy across all existing StackSet instances immediately without affecting other resources within the StackSet, and ensure that new deployments also receive the corrected policy. What is the most efficient and safest way to achieve this?
- APerform a 'rolling update' operation on the existing StackSet instance by instance.
- BUpdate the StackSet template with the corrected IAM policy and redeploy the StackSet.
- CManually update the IAM policy in each AWS account and Region.
- DCreate a new StackSet with the corrected IAM policy and delete the old one.
Show answer & explanationAnswer & explanation
Correct answer: B. Update the StackSet template with the corrected IAM policy and redeploy the StackSet.
Updating the StackSet template and redeploying it is the most efficient and safest way. StackSets will automatically propagate the changes to all existing stack instances and ensure new ones are created with the updated template, maintaining IaC principles.
Why the other options are wrong
- A. StackSets automatically handle the update of instances across accounts/Regions; there isn't a manual 'rolling update' operation per instance in the way described, and it would be inefficient for hundreds of accounts.
- C. Manually updating hundreds of IAM policies across multiple accounts and Regions is prone to errors, highly inefficient, and goes against IaC principles.
- D. Creating a new StackSet and deleting the old one would be disruptive, potentially leading to downtime and loss of resources not just the IAM policy.
CloudFormation StackSets Update
To update resources managed by CloudFormation StackSets, modify the StackSet's underlying CloudFormation template and then initiate an update operation on the StackSet.
- Modifies existing stack instances.
- Propagates changes to all target accounts/Regions.
- Maintains consistency across deployments.
- Uses the same template for future deployments.
Memory trick: StackSets: Update the master, and all its children will follow the new template's decree.