Examkin

Question

Difficulty: HardAWS CodeDeploy

An engineering team is setting up a CI/CD pipeline using AWS CodeDeploy to deploy a Node.js web application to a fleet of Amazon EC2 instances. The deployment configuration must ensure that the application is fully running and able to handle traffic before the deployment is marked as successful. Additionally, CodeDeploy requires authorization to interact with EC2 auto-scaling groups and load balancers during the deployment process.

Which of the following configurations must be implemented to meet these requirements? (Select TWO.)

  1. Configure an IAM service role for AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.Answer
  2. Use the ValidateService lifecycle hook in the appspec.yml file to execute a script that checks the application's local health endpoint.Answer
  3. C
    Use the BeforeAllowTraffic lifecycle hook in the appspec.yml file to run the integration test scripts before shifting traffic.
  4. D
    Modify the trust policy of the EC2 instance profile's IAM role to trust the codedeploy.amazonaws.com service principal.
  5. E
    Store the application's configuration parameters in AWS Systems Manager Parameter Store and grant the CodeDeploy service role secretsmanager:GetSecretValue permissions.

Answer

Configure an IAM service role for AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role, and use the ValidateService lifecycle hook in the appspec.yml file to execute a script that checks the application's local health endpoint.
To allow AWS CodeDeploy to perform deployments on EC2/On-Premises instances, it needs a service role that trusts the 'codedeploy.amazonaws.com' service principal. This role grants the service permission to interact with other AWS services like EC2, Auto Scaling, and Elastic Load Balancing. To verify the service health post-deployment, the 'ValidateService' lifecycle hook in the EC2 AppSpec file must be used to run validation scripts before CodeDeploy marks the deployment as successful.

Step-by-Step Solution

1
Determine the necessary IAM configuration for AWS CodeDeploy authorization.
Identify that AWS CodeDeploy must be configured with an IAM service role (not an EC2 instance profile) whose trust policy explicitly lists the 'codedeploy.amazonaws.com' service principal. This allows CodeDeploy to interact with EC2, Auto Scaling, and Elastic Load Balancing APIs.
Without this service role, CodeDeploy lacks the permissions to execute deployments across the target instances and infrastructure.
2
Map the correct AppSpec lifecycle hook for post-deployment verification on Amazon EC2.
Select the 'ValidateService' lifecycle hook inside the EC2 'appspec.yml' file to execute local verification scripts.
In EC2/On-Premises deployment groups, ValidateService is the proper hook for service validation, whereas hooks like BeforeAllowTraffic are restricted to ECS and Lambda deployment types.
3
Rule out incorrect trust policies and mismatched API permissions.
Discard modifications to the EC2 instance profile's trust policy (which must trust EC2, not CodeDeploy) and correct Systems Manager Parameter Store permissions (which require SSM API permissions rather than Secrets Manager permissions).
This isolates the correct configurations for service trust boundaries and parameter store access.

Key Concept

Configuring AWS CodeDeploy service roles and understanding EC2-specific AppSpec lifecycle hooks.
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic