Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring a deployment group in AWS CodeDeploy to deploy an application to a fleet of Amazon EC2 instances. The developer creates a new IAM role to serve as the service role for the deployment group. However, when the deployment is initiated, it fails immediately with a service role authorization error before any lifecycle event scripts in the appspec.yml file are executed. Which configuration issue is the most likely cause of this failure?

  1. A
    The trust policy of the IAM role attached to the EC2 instance profile is configured to allow codedeploy.amazonaws.com to assume the role instead of ec2.amazonaws.com.
  2. The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.Answer
  3. C
    The appspec.yml file is configured with the AfterAllowTraffic lifecycle hook, which is invalid for deployments targeting the Amazon EC2 compute platform.
  4. D
    The deployment group is configured to fetch the application source bundle from Systems Manager Parameter Store, which is not supported because CodeDeploy requires AWS Secrets Manager for source bundle retrieval.

Answer

The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.
The correct option is correct because AWS CodeDeploy needs to assume the specified service role to perform operations such as registering instances, updating Auto Scaling groups, and interacting with load balancers. This trust is established via the trust policy of the role, which must explicitly allow the 'codedeploy.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. If this trust policy is missing or incorrect, the CodeDeploy service cannot assume the role, and the deployment fails immediately with an authorization error.

Step-by-Step Solution

1
Analyze the timing and nature of the error, noting that the deployment fails immediately with a 'service role authorization error' before CodeDeploy attempts to connect to the target instances or run any lifecycle scripts.
This indicates that the issue lies with the permissions of the CodeDeploy service itself to act on the user's behalf, rather than an agent or configuration file issue on the EC2 instances.
Before any deployment actions can be orchestrated, the AWS CodeDeploy service must successfully assume the service role associated with the deployment group.
2
Examine the role requirements for AWS CodeDeploy to perform deployment actions on AWS resources.
CodeDeploy requires an IAM service role with a trust policy allowing the 'codedeploy.amazonaws.com' service principal to perform 'sts:AssumeRole'.
Without this trust policy, the AWS Security Token Service (STS) will reject CodeDeploy's request to assume the role, preventing the deployment from starting.
3
Differentiate between the CodeDeploy service role and the EC2 instance profile role, and rule out other configuration issues.
The EC2 instance profile role is assumed by the EC2 service to allow the agent to read from S3. The AppSpec file hooks and parameter configurations are parsed much later by the agent, so failures there would not occur immediately at the start of the deployment.
This confirms that the missing trust relationship on the CodeDeploy service role is the root cause of the immediate service role authorization failure.

Key Concept

AWS CodeDeploy IAM service role and trust relationship requirements
Rate this question

Topics

AWS CodeDeploy

More questions from this topic