Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation Lambda function after the test traffic is routed to the replacement task set but before the production traffic is shifted. Additionally, the developer must ensure that AWS CodeDeploy has the necessary permissions to execute the deployment steps and update the Application Load Balancer listeners. Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

  1. In the AppSpec file, specify the validation Lambda function under the AfterAllowTestTraffic hook in the Hooks section.Answer
  2. Configure the trust policy of the CodeDeploy service IAM role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  3. C
    In the AppSpec file, specify the validation Lambda function under the ApplicationStart hook in the Hooks section.
  4. D
    In the AppSpec file, specify the container image path and target container port in the files section.
  5. E
    Configure the trust policy of the ECS Task Execution Role to trust the codedeploy.amazonaws.com service principal to execute the validation Lambda function.

Answer

In the AppSpec file, specify the validation Lambda function under the AfterAllowTestTraffic hook in the Hooks section, and configure the trust policy of the CodeDeploy service IAM role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct configurations involve using the AfterAllowTestTraffic hook in the ECS AppSpec file to trigger the validation Lambda function after test traffic routing, and configuring the CodeDeploy service IAM role trust policy to allow codedeploy.amazonaws.com to assume the role. These steps ensure CodeDeploy has the authority to orchestrate the deployment and execute verification tests at the correct stage.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec lifecycle hook for validating an Amazon ECS blue/green deployment before production traffic is shifted.
Identify that AfterAllowTestTraffic is the designated hook that runs validation tests after the test traffic is routed to the new task set.
This hook provides a window to verify the health and behavior of the new version using test traffic before exposing it to live production users.
2
Examine the IAM configurations required for CodeDeploy to assume a service role and manage ECS and ALB resources.
Identify that the CodeDeploy service IAM role must have a trust policy configured with the codedeploy.amazonaws.com principal and the sts:AssumeRole action.
This trust policy allows the AWS CodeDeploy service to securely assume the role and perform administrative actions on behalf of the developer.

Key Concept

AWS CodeDeploy for Amazon ECS uses a specific set of lifecycle hooks in the AppSpec file (such as AfterAllowTestTraffic) and requires an IAM service role with a trust policy for the codedeploy.amazonaws.com service principal.
Rate this question

Topics

AWS CodeDeploy

More questions from this topic