Examkin

Question

Difficulty: HardAWS CodeDeploy

A developer is using AWS CodeDeploy to deploy a Node.js web application to a fleet of Amazon EC2 instances. During the initial deployment run, the deployment fails.

The developer inspects the deployment console and identifies two root causes:
1. The CodeDeploy service is unable to interact with the EC2 instances to initiate the deployment.
2. A bash script specified in the `appspec.yml` file fails with an access denied error when attempting to retrieve database credentials from AWS Systems Manager Parameter Store.

The application's `appspec.yml` file is configured as follows:

yaml
version: 0.0
os: linux
files:
- source: /index.js
destination: /var/www/html/
hooks:
BeforeInstall:
- location: scripts/decrypt_creds.sh
timeout: 300
runas: dbadmin

Which two configurations must the developer implement to resolve these issues? (Select TWO.)

  1. Configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  2. Attach an IAM policy that grants ssm:GetParameters and ssm:GetParameter permissions to the IAM role associated with the EC2 instance profile.Answer
  3. C
    Attach an IAM policy that grants ssm:GetParameters and ssm:GetParameter permissions directly to the CodeDeploy service role.
  4. D
    Change the hook in the appspec.yml file from BeforeInstall to BeforeAllowTraffic to execute the validation script before traffic shifting begins.
  5. E
    Migrate the credentials to AWS Secrets Manager, and grant the EC2 instance profile role permissions to retrieve them using the ssm:GetParameters policy action.

Answer

Configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action, and attach an IAM policy that grants ssm:GetParameters and ssm:GetParameter permissions to the IAM role associated with the EC2 instance profile.
The CodeDeploy service role requires a trust policy allowing the codedeploy.amazonaws.com service principal to assume the role. This permits the service to perform deployment orchestration. When the CodeDeploy agent runs scripts defined under the hooks section on the EC2 instance, the script processes assume the identity of the EC2 instance profile. Therefore, to fetch parameters from the Systems Manager Parameter Store, the instance profile's associated role must have the ssm:GetParameters and ssm:GetParameter permission policies attached.

Step-by-Step Solution

1
Analyze CodeDeploy service permissions.
The CodeDeploy service itself requires an IAM service role to communicate with EC2 instances. The trust relationship for this service role must explicitly permit the codedeploy.amazonaws.com service principal to execute the sts:AssumeRole action.
This establishes trust between CodeDeploy and the IAM role, allowing the service to orchestrate deployments.
2
Determine the execution environment of AppSpec script hooks.
Scripts defined in the AppSpec hooks section run locally on target EC2 instances, executed by the CodeDeploy agent daemon.
This helps locate which IAM role requires permissions to query external AWS APIs during script runs.
3
Assign Parameter Store permissions to the correct entity.
Assign ssm:GetParameter and ssm:GetParameters to the EC2 instance profile role rather than the CodeDeploy service role.
Because the agent running on the EC2 instance executes the decrypt_creds.sh script locally, it uses the credentials supplied by the EC2 instance profile.

Key Concept

AWS CodeDeploy Service Role vs. EC2 Instance Profile Permissions
Rate this question

Topics

AWS CodeDeploy

More questions from this topic