Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute an AWS Lambda function to run validation tests on the replacement task set after test traffic is routed, but before production traffic is shifted. The validation tests require a database password that must be rotated automatically every 30 days. Additionally, CodeDeploy requires an IAM service role to perform the deployment. Which configuration should the developer implement?

  1. A
    Configure the CodeDeploy service role trust policy to allow ecs-tasks.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.
  2. B
    Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password as a standard parameter in Systems Manager Parameter Store, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.
  3. Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.Answer
  4. D
    Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the ValidateService hook in the AppSpec file.

Answer

Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.
The correct configuration requires the AWS CodeDeploy service role to have a trust policy allowing codedeploy.amazonaws.com to assume it. For storing credentials that need automatic rotation, AWS Secrets Manager is the appropriate service as it has native integration for rotation (unlike Systems Manager Parameter Store). In Amazon ECS deployments, validation tests are run using the AfterAllowTestTraffic lifecycle hook in the AppSpec file, which runs after test traffic is routed but before production traffic is allowed. ValidateService is an EC2-specific lifecycle hook and is not supported in ECS deployments.

Step-by-Step Solution

1
Determine the required IAM trust policy principal for the CodeDeploy service role.
The trust policy must allow the principal codedeploy.amazonaws.com to assume the role.
CodeDeploy requires permission to assume the service role to orchestrate the deployment on behalf of the developer.
2
Identify the proper storage service for a database password requiring automatic rotation.
AWS Secrets Manager must be used instead of Systems Manager Parameter Store.
Secrets Manager natively supports automatic rotation (e.g., every 30 days) via built-in integration, whereas Parameter Store does not support automatic rotation natively.
3
Select the correct lifecycle hook for running validation tests on an ECS blue/green deployment.
The validation Lambda function must be defined under the AfterAllowTestTraffic hook in the AppSpec file.
ECS blue/green deployments support validation tests after test traffic is routed using the AfterAllowTestTraffic hook. ValidateService is an EC2-specific hook and cannot be used in ECS deployments.

Key Concept

AWS CodeDeploy deployment configuration, IAM service roles, secret rotation, and ECS lifecycle hooks.
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic