Examkin

Question

Difficulty: MediumTroubleshooting CloudFormation and CI/CD Deployments

A developer is configuring an AWS CodePipeline with an AWS CodeDeploy stage to deploy a containerized application to an Amazon ECS service using a blue/green deployment strategy. The deployment fails. The developer observes two issues:
1. The CodeDeploy deployment fails immediately with an error indicating an invalid AppSpec file configuration, where the developer specified `BeforeInstall` and `AfterInstall` lifecycle hooks.
2. The ECS tasks fail to start because they cannot download the application configuration file from an Amazon S3 bucket, despite the developer having attached the S3 read permissions to the ECS Task Execution Role.

Which two actions should the developer take to resolve these deployment issues? (Select TWO.)

  1. Replace the `BeforeInstall` and `AfterInstall` lifecycle hooks in the AppSpec file with `BeforeAllowTraffic` and `AfterAllowTraffic` hooks.Answer
  2. Move the S3 read permission policy from the ECS Task Execution Role to the ECS Task Role.Answer
  3. C
    Change the AppSpec lifecycle hooks to `ApplicationStart` and `ApplicationStop` to control container startup.
  4. D
    Attach the S3 read permission policy to the CodeDeploy service role since CodeDeploy manages the container tasks during deployment.
  5. E
    Modify the ECS Task Role trust policy to trust the Amazon S3 service instead of the Amazon ECS tasks service.

Answer

Replace the `BeforeInstall` and `AfterInstall` hooks with `BeforeAllowTraffic` and `AfterAllowTraffic`, and move the S3 read permission policy from the ECS Task Execution Role to the ECS Task Role.
The correct options modify the AppSpec hooks to use ECS-supported lifecycle hooks (`BeforeAllowTraffic` and `AfterAllowTraffic`) and assign S3 read permissions to the ECS Task Role, which is the role that containerized applications use to access AWS resources.

Step-by-Step Solution

1
Analyze the AppSpec lifecycle hook failure.
Identify that `BeforeInstall` and `AfterInstall` hooks are specific to EC2/On-Premises CodeDeploy deployments.
ECS deployments use specific hooks like `BeforeAllowTraffic` and `AfterAllowTraffic` for running lifecycle validation Lambda functions.
2
Analyze the Amazon S3 access failure from within the ECS tasks.
Determine that the application running inside the container needs permissions to access S3.
Permissions for containerized applications must be attached to the ECS Task Role, whereas the ECS Task Execution Role is for container agent operations like pulling images from ECR.
3
Select the correct combination of fixes.
The option to use ECS-supported hooks and the option to use the correct Task Role for S3 access are selected.
These steps address the invalid AppSpec structure and the permission mismatch.

Key Concept

Understanding ECS Task Roles vs Task Execution Roles, and ECS-specific CodeDeploy AppSpec lifecycle hooks.
Rate this question

Topics

Troubleshooting CloudFormation and CI/CD Deployments

More questions from this topic