A parks department hotfix changed a security group rule in the console. The nightly pipeline applies that stack from a Git repository and will run again tonight. How should the team keep the hotfix after the next apply?
Select an answer to reveal the explanation.
Short Explanation
The nightly pipeline is a photocopier, and it copies your Git repository over the console. You keep the hotfix only by writing that same rule into the repository the apply reads. Termination protection stops a delete, and it does not stop the template from putting the old rule back.
Full Explanation
The pipeline applies the template in the Git repository, and that template is the desired state of the security group. A console hotfix exists only in the live account, so the next apply changes the group back to the rule the repository still declares. Putting the same rule into that repository makes the hotfix part of the desired state, and the apply keeps it. Termination protection blocks stack deletion and some resource replacements. It does not pin an individual rule that the template still wants reverted, so the nightly run can remove the hotfix. Drift detection reports that the live group differs from the template. Accepting that report does not rewrite the Git source, and the following apply uses the repository again. Restoring a snapshot of the group after the run is a manual undo the next apply will reverse, because the pipeline never reads that snapshot. Caveat: a plan already approved from the previous commit still contains the old rule, so the hotfix has to be merged and that new commit has to be the one that runs. Operational check: from the new commit, run a plan-only apply and confirm the security group rule no longer appears as a change.