Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring an AWS CodeDeploy blue/green deployment for a microservice on Amazon ECS. The deployment must execute a validation Lambda function named `run-integration-tests` immediately after the load balancer routes test traffic to the replacement task set, but before production traffic is shifted. Additionally, the Lambda function needs to retrieve a database credential that must be rotated automatically every 30 days.

Here is a snippet of the AppSpec file being used:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/api-service:2"
LoadBalancerInfo:
ContainerName: "api"
ContainerPort: 8080
Hooks:
- <HOOK_NAME>: "arn:aws:lambda:us-east-1:123456789012:function:run-integration-tests"

Which combination of CodeDeploy lifecycle hook and AWS service configuration will satisfy these requirements?

  1. A
    Hook: ValidateService; Service: AWS Secrets Manager
  2. Hook: AfterAllowTestTraffic; Service: AWS Secrets ManagerAnswer
  3. C
    Hook: AfterAllowTestTraffic; Service: AWS Systems Manager Parameter Store
  4. D
    Hook: BeforeAllowTraffic; Service: AWS Secrets Manager, with the CodeDeploy service role trusting the ecs.amazonaws.com service principal

Answer

Hook: AfterAllowTestTraffic; Service: AWS Secrets Manager
The correct configuration uses the AfterAllowTestTraffic hook to trigger the validation Lambda function. In an Amazon ECS deployment, AfterAllowTestTraffic runs after the test listener starts routing traffic to the replacement task set, allowing validation tests to execute before production traffic is shifted. Storing the database password in AWS Secrets Manager is correct because Secrets Manager natively supports automatic rotation of secrets (such as database credentials), whereas Systems Manager Parameter Store does not provide built-in automatic rotation.

Step-by-Step Solution

1
Identify the target deployment platform and the phase where validation tests must run.
The target platform is Amazon ECS. To validate the replacement tasks using test traffic before production traffic is routed, the AfterAllowTestTraffic hook must be used.
AfterAllowTestTraffic executes immediately after test traffic begins routing to the replacement task set, providing the correct window for integration tests.
2
Determine the service to store the database credential based on the security requirements.
AWS Secrets Manager is selected because the database credential requires automatic rotation.
AWS Secrets Manager supports built-in automatic rotation for database credentials, while Systems Manager Parameter Store is primarily for configuration management and does not support native automatic rotation.
3
Validate the IAM service role trust policy requirements for CodeDeploy.
The CodeDeploy service role must allow the 'codedeploy.amazonaws.com' service principal to assume the role.
Configuring the trust policy for 'ecs.amazonaws.com' instead of 'codedeploy.amazonaws.com' will prevent CodeDeploy from assuming the role to perform the deployment.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for Amazon ECS and credential rotation using AWS Secrets Manager.
Estimated Time:1m 30s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic