Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring AWS CodeDeploy to perform in-place deployments of a web application to a fleet of Amazon EC2 instances. The deployment group is configured, but the deployments fail immediately at the start with an error indicating that CodeDeploy does not have permission to access the target instances. The developer needs to ensure that the CodeDeploy service has the necessary permissions to perform the deployment.

Which configuration change will resolve this issue?

  1. A
    Add ECS-specific lifecycle hooks such as BeforeAllowTraffic and AfterAllowTraffic to the appspec.yml file to allow traffic routing.
  2. Update the trust policy of the CodeDeploy IAM service role to allow the codedeploy.amazonaws.com service principal to assume the role.Answer
  3. C
    Update the trust policy of the EC2 instance profile role to allow the ec2.amazonaws.com service principal to assume the role.
  4. D
    Store the CodeDeploy service role credentials as a secure string in AWS Systems Manager Parameter Store and retrieve them using an instance bootstrap script.

Answer

Updating the trust policy of the CodeDeploy IAM service role to trust the CodeDeploy service principal.
Updating the trust policy of the CodeDeploy IAM service role to allow the codedeploy.amazonaws.com service principal to assume the role is correct. CodeDeploy requires a service role with permissions to access EC2 instances and ECS services on your behalf, and this role must trust the CodeDeploy service principal so that AWS CodeDeploy can assume it using AWS Security Token Service (STS).

Step-by-Step Solution

1
Identify the service role configured for the CodeDeploy deployment group.
The specific IAM role used by CodeDeploy is identified.
Deployments require a service role with appropriate permissions to execute actions.
2
Verify the trust relationship of the identified IAM service role in the IAM console.
The trust policy is found to be missing or misconfigured for the CodeDeploy service principal.
To assume a service role, AWS CodeDeploy must be allowed in the trust policy.
3
Modify the trust policy of the IAM service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The role's trust policy is successfully updated, allowing CodeDeploy to assume it.
This resolves the authorization failure and allows CodeDeploy to manage the deployment.

Key Concept

IAM service roles and trust policies for AWS CodeDeploy
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic