Question

A DevOps team manages a production CloudFormation stack that contains an RDS database, an EC2 Auto Scaling group, and several application resources. During routine template updates, engineers have accidentally triggered replacement of the RDS instance twice, causing outages. The team wants a mechanism that blocks updates to the database resource specifically while still allowing the rest of the stack to be updated freely through the normal pipeline, without relying on engineers remembering to add flags at deploy time. Which approach BEST satisfies this requirement?

Accepted Answer

Apply a stack policy to the stack that denies Update:Replace and Update:Delete actions on the RDS resource's logical ID while allowing all update actions on other resources.

Answer

Add a DeletionPolicy of Retain to the RDS resource in the template so the database is never replaced during updates.

Answer

Enable termination protection on the stack so that no resources can be replaced during an update operation.

Answer

Move the RDS resource into a nested stack and set the nested stack's UpdateReplacePolicy to Retain so the parent stack cannot modify it.