Examkin

Question

Difficulty: Very hardAWS CodeDeploy

A developer is migrating a containerized web application from Amazon EC2 instances to Amazon ECS. The deployment process is managed by AWS CodeDeploy using a Blue/Green deployment configuration. Before production traffic is shifted to the replacement task set, the deployment must execute a database migration script. This script retrieves a database password that must be automatically rotated every 30 days.

The developer writes the following `appspec.yaml` file for the Amazon ECS service:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:111122223333:task-definition/my-app:1"
LoadBalancerInfo: ContainerName: "web"
ContainerPort: 80
Hooks:
- AfterInstall:
- location: "scripts/migrate.sh"
timeout: 600

Which set of actions must the developer perform to ensure the database migration runs successfully and complies with the rotation requirement?

  1. Package the database migration script into an AWS Lambda function and update the `AfterInstall` hook in the `appspec.yaml` to reference the Lambda function's ARN. Store the database password in AWS Secrets Manager with automatic rotation enabled, and grant the Lambda function's execution role permissions to retrieve the secret.Answer
  2. B
    Keep the `appspec.yaml` hooks structure as is to run the migration script directly, but update the Amazon ECS task execution role's trust policy to trust `codedeploy.amazonaws.com`. Store the password in AWS Systems Manager Parameter Store as a SecureString with native automatic rotation enabled.
  3. C
    Change the hook in the `appspec.yaml` from `AfterInstall` to `ValidateService` to run the migration script, and keep the shell script location path. Store the database password in AWS Systems Manager Parameter Store, and configure an Amazon EventBridge rule to trigger a custom rotation Lambda function.
  4. D
    Package the database migration script into an AWS Lambda function and update the `AfterInstall` hook to reference the Lambda function's ARN. Store the database password in AWS Systems Manager Parameter Store, and configure the Lambda function's trust policy to trust `codedeploy.amazonaws.com` so CodeDeploy can assume the function role directly.

Answer

Package the database migration script into an AWS Lambda function, update the `AfterInstall` hook to reference its ARN, store the password in AWS Secrets Manager with automatic rotation, and allow the Lambda execution role to retrieve the secret.
The correct answer correctly identifies that Amazon ECS AppSpec files require lifecycle hooks to point to AWS Lambda functions rather than local shell scripts. It also correctly chooses AWS Secrets Manager over Systems Manager Parameter Store because Secrets Manager features native, built-in support for rotating credentials automatically.

Step-by-Step Solution

1
Analyze the AppSpec file hooks syntax for Amazon ECS.
Identify that the `location` parameter and shell script execution are only supported for EC2/On-Premises deployments. ECS deployments require hooks to point directly to AWS Lambda functions.
To ensure CodeDeploy can execute the database migration hook on the ECS compute platform.
2
Evaluate the database password rotation requirement.
Determine that AWS Secrets Manager provides built-in, out-of-the-box automatic rotation for database secrets, whereas AWS Systems Manager Parameter Store does not support native rotation.
To meet the compliance requirement of rotating the database password every 30 days with minimal administrative overhead.
3
Configure the Lambda function's IAM permissions.
Create an IAM execution role for the Lambda function and attach a policy allowing the `secretsmanager:GetSecretValue` action.
To allow the migration Lambda function to securely retrieve the database credentials during execution.

Key Concept

AWS CodeDeploy AppSpec configuration for Amazon ECS and Secrets Management integration
Estimated Time:3m 0s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic