A DevOps engineer has used a CloudFormation template to create an RDS resource for a new web application. The RDS database has used the engine of PostgreSQL, and the encryption is not enabled. However, for certain security considerations, the database needs to be updated to enable encryption. The CloudFormation template is updated accordingly (StorageEncrypted is true). To prevent data loss during the CloudFormation stack update, the data should be restored from the latest DB snapshot. Which two steps should be taken in combination to meet this requirement? (Select TWO.)

Answer options:

A.Make sure that automated snapshots are working properly and record the last snapshot ARN ID.B.Deactivate any applications that are using the DB instance and then create a manual snapshot.
C.Add a Stack Policy in the CloudFormation stack to prevent the DB resource from being deleted.
D.Add the DBSnapshotIdentifier property with the ID of the used DB snapshot.
E.Add a DeletionPolicy of Snapshot in the CloudFormation template.

Correct Answer – B, D
When StorageEncrypted is modified, and the CloudFormation is updated, the DB instance is deleted and replaced with a new one. Check https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-dbsnapshotidentifier for details.
In the meantime, the CloudFormation template needs to use DBSnapshotIdentifier to point to the DB snapshot which the CloudFormation stack will use.
Option A is incorrect: Because if a DB instance is deleted or replaced during an update, AWS CloudFormation deletes all automated snapshots. However, it retains manual DB snapshots.
Refer the link: https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html
Option B is CORRECT: Because the manual snapshot can preserve the data well, and the snapshot ARN will be used by the CloudFormation template. Refer to option
D.Option C is incorrect: Because the original DB instance is not used anymore. A new instance is required in which the encryption is enabled. So this option does not help to resolve the problem.
Option D is CORRECT: Because AWS CloudFormation creates a new database from the specified snapshot according to DBSnapshotIdentifier. Please refer to https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-properties-rds-database-instance.html#cfn-rds-dbinstance-dbsnapshotidentifier for the recommended approaches when updating DB instances.
Option E is incorrect: Because this option only takes a snapshot before tearing down the original DB instance. Instead, a manual snapshot is required, and its ARN should be provided to the CloudFormation template.