Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation AWS Lambda function to verify the health of the new task set before shifting production traffic. The validation function requires access to a database password that must be automatically rotated every 30 days. Additionally, the CodeDeploy service itself requires permissions to manage the ECS deployment. Which combination of configurations should the developer use to meet these requirements?

  1. Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.Answer
  2. B
    Configure the BeforeInstall hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.
  3. C
    Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Systems Manager Parameter Store as a SecureString parameter; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.
  4. D
    Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows ecs-tasks.amazonaws.com to assume the role.

Answer

Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.
The correct configuration uses the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function, stores the database password in AWS Secrets Manager to support automatic rotation, and assigns CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Step-by-Step Solution

1
Determine the correct CodeDeploy lifecycle hook in the appspec.yaml file for invoking validation tests on Amazon ECS.
The BeforeAllowTraffic hook is identified as the valid lifecycle hook for ECS deployments.
ECS deployments only support BeforeAllowTraffic and AfterAllowTraffic hooks for running validation Lambda functions, whereas BeforeInstall is an EC2 hook.
2
Select the AWS service to store the database password with automatic 30-day rotation support.
AWS Secrets Manager is selected.
AWS Secrets Manager natively supports automatic rotation of database credentials, whereas Systems Manager Parameter Store does not provide built-in automatic rotation.
3
Verify the trust policy configuration for the IAM role assumed by AWS CodeDeploy.
The trust policy must allow the codedeploy.amazonaws.com service principal to assume the role.
AWS CodeDeploy needs permission to interact with ECS on the developer's behalf. The trust relationship must be with codedeploy.amazonaws.com, not ecs-tasks.amazonaws.com.

Key Concept

AWS CodeDeploy deployment configuration for ECS including AppSpec lifecycle hooks, Secrets Manager integration, and IAM trust policies.
Estimated Time:1m 30s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic