As a DevOps engineer, you are updating several AWS CloudFormation scripts to make them resilient against unexpected updates and overwritten passwords. What ideas are considered recommended practices when it comes to solve these sorts of automation scenarios?

Answer options:

A.Create a change set with create-change-set, run list-change-sets to get the ID of the change set for a stack, call a describe-change-set operation to get the Changes field containing the list that describes the resources AWS CloudFormation changes if you execute the change set. Set a stack policy for the stack specifying either the StackPolicyBody or the StackPolicyURL parameters to prevent updates to the stack resources. To avoid overwritten passwords, specify the UsePreviousValue input parameter for the change set in the create-change-set operation to true.
B.Create a change set with create-change-set, run list-change-sets to get the Changes field containing the list that describes the resources AWS CloudFormation changes if you execute the change set. Set a stack policy for the stack specifying either the StackPolicyBody or the StackPolicyURL parameters to prevent updates to the stack resources. To avoid overwritten passwords, specify the UseCurrentValue input parameter for the change set in the create-change-set operation to false.
C.Create a change set with create-change-set, call a describe-change-set to get the ID of the change set for a stack operation, run list-change-sets to get the Changes field containing the list that describes the resources AWS CloudFormation changes if you execute the change set. Set a stack policy for the stack specifying either the StackPolicyBody or the StackPolicyURL parameters to prevent updates to the stack resources. To avoid overwritten passwords, specify the UsePreviousValue input parameter for the change set in the create-change-set operation to true.
D.Create a change set with create-change-set, call a describe-change-set operation to get the ID of the change set for a stack operation that describes the resources AWS CloudFormation changes if you execute the change set. Set a stack policy for the stack specifying either the StackPolicyBody or the StackPolicyURL parameters to prevent updates to the stack resources. To avoid overwritten passwords, specify the UseCurrentValue input parameter for the change set in the create-change-set operation to false.

Correct Answer: A
The question is a clear mention to change sets since there is a need to protect against unexpected updates and overwritten passwords, this is possible in AWS CloudFormation via change sets. The right order to do this is by creating the change set, listing the change sets to get the ID and then describing it to be able to see the list of changes. All of these steps do not execute the change set. When creating the change set, you can use the UsePreviousValue input parameter in order to not overwrite the current password.
Incorrect Answers:
Option B is incorrect because running list-change-sets does not give you the Changes field containing the list that describes the resources AWS CloudFormation changes if you execute the change set, that’s possible only via a describe-change-set operation. Also, there is no UseCurrentValue input parameter for the change set in the create-change-set operation.
Option C is incorrect because a list-change-sets operation does not give you the Changes field containing the list that describes the resources AWS CloudFormation changes if you execute the change set, that’s possible only via a describe-change-set operation.
Option D is incorrect because there is no UseCurrentValue input parameter for the change set in the create-change-set operation.
References:
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/best-practices.html
https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/using-cfn-updating-stacks-changesets.html