Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is writing an appspec.yml file for an in-place deployment to Amazon EC2 instances using AWS CodeDeploy. The developer needs to execute a shell script to gracefully stop the running web server application before the new deployment bundle is downloaded. Additionally, the script requires retrieving database credentials that must undergo automatic rotation. How should the developer configure the deployment to meet these requirements?

  1. A
    Specify the script under the BeforeAllowTraffic lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.
  2. B
    Specify the script under the BeforeInstall lifecycle hook in the appspec.yml file, and configure the EC2 instance profile's IAM trust policy to trust the CodeDeploy service to allow the script to execute.
  3. Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.Answer
  4. D
    Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and configure AWS Systems Manager Parameter Store to automatically rotate the database credentials.

Answer

Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.
The correct configuration is to target the ApplicationStop lifecycle hook. In an EC2 in-place deployment, ApplicationStop is the first hook to execute and runs before the new deployment bundle is downloaded (DownloadBundle phase). Additionally, AWS Secrets Manager is the correct service for retrieving the rotated database credentials, as it natively supports automatic rotation of secrets, unlike Systems Manager Parameter Store.

Step-by-Step Solution

1
Determine the correct CodeDeploy lifecycle hook for EC2 that runs before downloading files.
The ApplicationStop hook is identified as the first lifecycle event in an EC2 deployment, executing prior to the DownloadBundle event.
Running the shutdown script during ApplicationStop ensures the web server is stopped before the new package is downloaded or copied.
2
Select the appropriate secrets service that supports automatic rotation.
AWS Secrets Manager is chosen instead of Systems Manager Parameter Store.
AWS Secrets Manager provides built-in, automated credential rotation, meeting the security rotation requirement directly.
3
Configure the script to retrieve the secret at runtime.
The shell script uses the AWS CLI to fetch the secrets from Secrets Manager dynamically using the permissions assigned to the EC2 instance profile.
This avoids hardcoding credentials in the appspec.yml or deployment bundle, maintaining compliance with security best practices.

Key Concept

CodeDeploy EC2 Deployment Lifecycle Hooks and Secrets Management
Estimated Time:1m 30s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic