Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring an AWS CodeDeploy deployment group to perform a blue/green deployment for an Amazon ECS service. The developer wants to run validation tests against the replacement task set using a test listener before routing production traffic. The deployment fails during the validation phase. Upon reviewing the logs, the developer discovers that the AppSpec file specifies an invalid lifecycle hook for the ECS compute platform, and CodeDeploy is unable to invoke the validation Lambda function due to incorrect IAM permissions. Which combination of configurations will correctly resolve these issues?

  1. Change the AppSpec lifecycle hook to AfterAllowTestTraffic and ensure that the CodeDeploy service role is granted lambda:InvokeFunction permissions.Answer
  2. B
    Change the AppSpec lifecycle hook to ValidateService and ensure that the CodeDeploy service role is granted lambda:InvokeFunction permissions.
  3. C
    Change the AppSpec lifecycle hook to AfterAllowTestTraffic and add codedeploy.amazonaws.com to the trust policy of the validation Lambda function's IAM execution role.
  4. D
    Change the AppSpec lifecycle hook to AfterAllowTestTraffic and store the Lambda function's database credentials in AWS Systems Manager Parameter Store with automatic rotation enabled.

Answer

Change the AppSpec lifecycle hook to AfterAllowTestTraffic and ensure that the CodeDeploy service role is granted lambda:InvokeFunction permissions.
The correct option is the one that changes the AppSpec lifecycle hook to AfterAllowTestTraffic and ensures that the CodeDeploy service role is granted lambda:InvokeFunction permissions. In an Amazon ECS blue/green deployment, the AfterAllowTestTraffic hook runs validation tests after test traffic is routed to the replacement task set. Additionally, the CodeDeploy service role requires permission to invoke the validation Lambda function.

Step-by-Step Solution

1
Identify the correct AWS CodeDeploy lifecycle hook for Amazon ECS.
Amazon ECS deployments support specific hooks such as BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic. The ValidateService hook is only for EC2/on-premises deployments.
Choosing the correct hook ensures CodeDeploy runs the validation tests at the correct phase of the blue/green deployment.
2
Determine the necessary IAM configuration to allow CodeDeploy to invoke the validation Lambda function.
The CodeDeploy service role requires the lambda:InvokeFunction permission. The Lambda function's execution role does not need its trust policy updated to trust CodeDeploy because CodeDeploy does not assume the Lambda role to invoke it.
Granting direct invocation permissions to the CodeDeploy service role allows it to trigger the validation Lambda function.

Key Concept

AWS CodeDeploy ECS blue/green deployment lifecycle hooks and IAM permissions
Rate this question

Topics

AWS CodeDeploy

More questions from this topic