DOP-C02 Practice Question 18: CloudFormation Update Rollback Failed
AWS Certified DevOps Engineer – Professional (DOP-C02) · Test 2 · question 8 of 10
A CloudFormation stack that holds a production Amazon RDS database and its supporting resources fails an update, and the stack then shows UPDATE_ROLLBACK_FAILED. The stack events show that the rollback could not restore an AWS::EC2::SecurityGroup resource, because an engineer deleted that security group by hand during the incident. The team must return the stack to a state in which it can be updated again, without deleting the stack.
What should the team do?
Show answer and explanation
Answer:
UPDATE_ROLLBACK_FAILED means CloudFormation could not undo every change it made during the update. The CloudFormation docs use this very case as their example: a resource the rollback expected was deleted outside CloudFormation. A stack in this state "can't be updated, but it can be rolled back to a working state (UPDATE_ROLLBACK_COMPLETE)". Continue update rollback retries the rollback, and when the cause cannot be fixed, its advanced option ResourcesToSkip lists the logical IDs of resources that failed *during the rollback*. CloudFormation marks them UPDATE_COMPLETE and finishes rolling back everything else. The docs warn that skipped resources will then be inconsistent with the template, and that you must reconcile them before the next update, or later updates may fail and the stack may become unrecoverable. That is why the answer includes the reconciliation step.
Option B looks like it fixes the cause but does not. CloudFormation tracks the security group by its *physical* ID (sg-...), and a new group with the same name and rules gets a different ID. The rollback still tries to reach the original ID and fails again.
Option C is not allowed. A stack in UPDATE_ROLLBACK_FAILED cannot accept a stack update. It must first be rolled back to UPDATE_ROLLBACK_COMPLETE.
Option D confuses two operations. cancel-update-stack cancels an update that is *in progress*, which starts a rollback. It does not apply to a rollback that has already failed, and it never leaves a stack in UPDATE_COMPLETE with partial changes in place.
Reference: Continue rolling back an update