Examkin

Question

Difficulty: HardAWS CodeDeploy

An engineering team is implementing canary deployments for an AWS Lambda function using AWS CodeDeploy. They define the following `appspec.yaml` file to run validation tests on the new function version before traffic is shifted:

yaml
version: 0.0
Resources:
- myLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "myLambdaFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"
Hooks:
- BeforeAllowTraffic: "RunSanityCheck"

The CodeDeploy service role has the AWS-managed policy `AWSCodeDeployRoleForLambda` attached. During execution, the deployment immediately fails at the `BeforeAllowTraffic` lifecycle hook event.

Which of the following is the correct explanation for this deployment failure?

  1. The CodeDeploy service role lacks permissions to invoke the validation function because the AWS-managed policy restricts `lambda:InvokeFunction` to functions prefixed with `CodeDeployHook_`.Answer
  2. B
    The validation function must be specified under the `BeforeInstall` hook in the `appspec.yaml` file, as the `BeforeAllowTraffic` hook is only supported on Amazon EC2 deployments.
  3. C
    The validation function's IAM execution role trust policy does not permit the CodeDeploy service principal (`codedeploy.amazonaws.com`) to assume the role.
  4. D
    The validation function is attempting to retrieve database credentials from AWS Systems Manager Parameter Store, but the AppSpec file must define these secrets in the resources section for CodeDeploy to inject them.

Answer

The CodeDeploy service role lacks permissions to invoke the validation function because the AWS-managed policy restricts `lambda:InvokeFunction` to functions prefixed with `CodeDeployHook_`.
The standard AWS-managed policy `AWSCodeDeployRoleForLambda` restricts the `lambda:InvokeFunction` permission to functions whose names start with the prefix `CodeDeployHook_`. Because the validation function is named `RunSanityCheck`, the CodeDeploy service role is not authorized to invoke it, leading to a failure during the `BeforeAllowTraffic` hook execution and triggering an automatic rollback.

Step-by-Step Solution

1
Analyze the AppSpec file for the compute platform target and hooks.
The target is AWS Lambda, and the validation hook `RunSanityCheck` is registered under `BeforeAllowTraffic`.
This confirms the hook placement and names conform to the AWS Lambda AppSpec specification.
2
Examine the IAM permissions of the CodeDeploy service role with `AWSCodeDeployRoleForLambda` attached.
The policy permits `lambda:InvokeFunction` but restricts the resource ARN to `arn:aws:lambda:*:*:function:CodeDeployHook_*`.
This is a security best practice built into the AWS-managed policy to prevent CodeDeploy from executing arbitrary Lambda functions.
3
Compare the validation function name with the policy constraint.
The function name `RunSanityCheck` does not start with `CodeDeployHook_`, triggering an AccessDenied exception during invocation.
Identifying the naming mismatch resolves why the deployment fails at the lifecycle hook execution step.

Key Concept

AWS CodeDeploy Lambda Hook Validation Permissions
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic