Exam AWS Certified Solutions Architect - Professional topic 1 question 687 discussion

it's C

C : Supporting link : https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html#protect-stack-resources-modifying Prevent replacement updates for an instance The following policy denies updates that would cause a replacement of the instance with the MyInstance logical ID. It allows all update actions on all other stack resources with an Allow statement. The Allow statement doesn't apply to the MyInstance resource because the Deny statement always overrides allow actions. Prevent replacement updates for an instance The following policy denies updates that would cause a replacement of the instance with the MyInstance logical ID. It allows all update actions on all other stack resources with an Allow statement. The Allow statement doesn't apply to the MyInstance resource because the Deny statement always overrides allow actions.

cccccccc

C. Add a second statement that specifies ג€Effectג€: ג€Denyג€, ג€Actionג€:[ג€Update:Deleteג€, ג€Update:Replaceג€] for all logical RDS resources.

C is right

CCCCCCC

C is correct

CCC ---

I'll go with C

c for sure.!

D is correct, with Update: * (representing delete & replace) on 2nd statement. This explicitly denies any updates to database resources only. You do not have to explicitly indicate Update with delete and replace (like what option C did).

This answer is C. Question is about CloudFormation Stack Policy, not CLI. "Update:Delete" and "Update:Replace" should be applied for only RDS. C explains that. https://docs.aws.amazon.com/ja_jp/AWSCloudFormation/latest/UserGuide/protect-stack-resources.html

i agree with C

Should be C, policies are implicit deny and explicit allow.

Sorry its B, you modify the the same statement

C { "Statement" : [ { "Effect" : "Deny", "Action" : "Update:*", "Principal": "*", "Resource" : "LogicalResourceId/MyDatabase" }, { "Effect" : "Allow", "Action" : "Update:*", "Principal": "*", "Resource" : "*" } ] }