Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring AWS CodeDeploy to deploy a Python web application to a fleet of Amazon EC2 instances. The deployment process must retrieve database credentials securely from AWS Systems Manager Parameter Store (stored as a `SecureString` parameter) and execute a database migration script before the application starts and begins accepting traffic.

Which two actions must the developer perform to meet these requirements?

  1. Grant the Amazon EC2 instance profile IAM role the `ssm:GetParameters` and `kms:Decrypt` permissions.Answer
  2. Execute the database migration script during the `AfterInstall` lifecycle hook in the `appspec.yml` file.Answer
  3. C
    Execute the database migration script during the `BeforeAllowTraffic` lifecycle hook in the `appspec.yml` file.
  4. D
    Grant the AWS CodeDeploy service role the `ssm:GetParameters` and `kms:Decrypt` permissions.
  5. E
    Define the Parameter Store parameters in the `resources` section of the `appspec.yml` file to inject them as environment variables.

Answer

Granting the Amazon EC2 instance profile IAM role the necessary decrypt permissions and executing the migration script during the AfterInstall lifecycle hook in the appspec.yml file.
To successfully run the database migration before the application starts, the script must execute during a valid EC2 lifecycle hook like `AfterInstall`. Since the script runs on the EC2 instances, the instance profile IAM role must have permissions to retrieve the SecureString parameter and decrypt it using the associated KMS key.

Step-by-Step Solution

1
Identify the entity executing the deployment scripts.
The CodeDeploy agent runs on the EC2 instances and executes the AppSpec lifecycle hook scripts.
This determines that permissions to fetch parameters must be assigned to the EC2 instance profile role, not the CodeDeploy service role.
2
Select the correct CodeDeploy lifecycle hook for EC2.
The `AfterInstall` hook runs on EC2 instances before the application starts.
This ensures the schema migration is completed before the web server begins running.
3
Grant the EC2 instance profile access to Systems Manager Parameter Store and AWS KMS.
Add `ssm:GetParameters` and `kms:Decrypt` to the instance profile role's policy.
The script running on the instance must be authorized to pull and decrypt the database credentials.

Key Concept

AWS CodeDeploy EC2 deployments rely on the CodeDeploy agent running under the instance profile's IAM permissions and execute scripts within EC2-specific lifecycle hooks such as AfterInstall.
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic