Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring a blue/green deployment for an application on Amazon ECS using AWS CodeDeploy. The deployment must execute a validation test suite to verify the application's health using a test traffic port before the production traffic is routed to the new task set. Additionally, CodeDeploy must be configured with the necessary permissions to manage the ECS deployment. Which of the following configurations must the developer perform? (Select TWO.)

  1. Define a validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.Answer
  2. Configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  3. C
    Define a validation script under the ValidateService hook in the AppSpec file.
  4. D
    Configure the trust policy of the ECS task execution role to allow the ecs.amazonaws.com service principal to assume the CodeDeploy service role.
  5. E
    Store the database credentials in Systems Manager Parameter Store as a String parameter type to enable automatic credentials rotation.

Answer

Define a validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct options involve configuring the AfterAllowTestTraffic lifecycle hook in the AppSpec file to invoke a validation Lambda function on the test port, and setting up the CodeDeploy service role's trust policy to allow the codedeploy.amazonaws.com service principal to assume it.

Step-by-Step Solution

1
Identify the correct AppSpec lifecycle hook for Amazon ECS validation tests.
Determine that the AfterAllowTestTraffic hook is executed after the test traffic port is directed to the replacement task set, which is the correct time to run validation tests.
ECS deployments use specific hooks like AfterAllowTestTraffic to validate the replacement task set using a test port before moving production traffic.
2
Establish the necessary IAM permissions for CodeDeploy to perform the deployment.
Identify that the CodeDeploy service role must have a trust policy allowing the codedeploy.amazonaws.com service principal to assume the role.
Without this trust policy, CodeDeploy will fail to assume the role and will not be able to interact with Amazon ECS to manage the deployment.

Key Concept

AWS CodeDeploy ECS Deployment Configuration
Rate this question

Topics

AWS CodeDeploy

More questions from this topic