Which solution will meet these requirements?

A company uses AWS CloudFormation to deploy its application infrastructure Recently, a user accidentally changed a property of a database in a CloudFormation template and performed a stack update that caused an interruption to the application A SysOps administrator must determine how to modify the deployment process to allow the DevOps team to continue to deploy the infrastructure, but prevent against accidental modifications to specific resources.

Which solution will meet these requirements?
A . Set up an AWS Config rule to alert based on changes to any CloudFormation stack An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation
B . Set up an Amazon CloudWatch Events event with a rule to trigger based on any CloudFormation API call An AWS Lambda function can then describe the stack to determine if any protected resources were modified and cancel the operation
C . Launch the CloudFormation templates using a stack policy with an explicit allow for all resources and an explicit deny of the protected resources with an action of Update
D . Attach an IAM policy to the DevOps team role that prevents a CloudFormation stack from updating, with a condition based on the specific Amazon Resource Names (ARNs) of the protected resources

View Answer

Answer: C

Explanation:

A stack policy is used to protect specific resources within a CloudFormation stack from being unintentionally updated or deleted. By using a stack policy, you can explicitly deny updates to critical resources while allowing updates to other parts of the stack.

Create a Stack Policy:

Define a JSON stack policy that includes an explicit allow for all resources and an explicit deny for the protected resources. For example:

json

Copy code

{

"Statement": [

{

"Effect": "Allow",

"Action": "Update:*",

"Principal": "*",

"Resource": "*"

},

{

"Effect": "Deny",

"Action": "Update:*",

"Principal": "*",

"Resource": "arn:aws:cloudformation:region:account-id:stack/stack-name/protected-resource"

}

]

}

Replace region, account-id, stack-name, and protected-resource with the appropriate values.

Apply the Stack Policy:

Navigate to the CloudFormation console.

Select the stack you want to protect.

Choose "Stack actions" and then "Edit stack policy".

Paste the stack policy JSON and save the policy.

Perform Stack Updates:

When performing stack updates, the stack policy will enforce the rules specified, preventing accidental updates to the protected resources.

Review and Adjust:

Periodically review the stack policy to ensure it still meets the needs of the organization and update it as necessary.

Reference: AWS CloudFormation Stack Policies

Creating and Applying a Stack Policy