Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute an AWS Lambda function to run validation tests on the replacement task set before production traffic is shifted. The validation tests require retrieving a database password that must be rotated automatically every 30 days. Additionally, the developer must configure the IAM trust policy for the CodeDeploy service role to allow the service to perform the deployment.

Which configuration should the developer implement?

  1. A
    Configure the validation Lambda function under the `ValidateService` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.
  2. B
    Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `ecs-tasks.amazonaws.com` to assume the role.
  3. C
    Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Systems Manager Parameter Store, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.
  4. Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.Answer

Answer

Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file, store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.
The correct configuration uses the `AfterInstall` lifecycle hook in the `appspec.yaml` file, which is valid for ECS blue/green deployments to run validation tests on the replacement task set before traffic routing. It stores the database password in AWS Secrets Manager because Secrets Manager natively supports automatic rotation of secrets. Lastly, the CodeDeploy service role trust policy must allow `codedeploy.amazonaws.com` to assume the role so CodeDeploy can perform the deployment tasks.

Step-by-Step Solution

1
Determine the appropriate lifecycle hook for running validation tests on Amazon ECS in AWS CodeDeploy.
The `AfterInstall` hook is selected.
In ECS blue/green deployments, CodeDeploy supports specific hooks such as `AfterInstall` and `AfterAllowTestTraffic` to run validation Lambda functions. Hooks like `ValidateService` are EC2-specific and not supported on ECS.
2
Evaluate the requirement for rotating a database password automatically.
AWS Secrets Manager is chosen.
AWS Secrets Manager natively supports automatic rotation of secrets (e.g., every 30 days) using built-in or custom Lambda functions. AWS Systems Manager Parameter Store does not support native automatic rotation.
3
Determine the service principal for the CodeDeploy service role trust policy.
Configure `codedeploy.amazonaws.com` as the trusted entity.
The service performing the deployment (AWS CodeDeploy) needs permission to assume the role. The principal `ecs-tasks.amazonaws.com` is used for ECS tasks to gain permissions to AWS resources, not for the CodeDeploy deployment service itself.

Key Concept

Understanding the differences between Amazon ECS and EC2 CodeDeploy lifecycle hooks, choosing appropriate AWS storage options for rotated secrets, and configuring proper IAM service trust policies.
Rate this question

Topics

AWS CodeDeploy

More questions from this topic