Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is setting up an automated canary deployment for an AWS Lambda function using AWS CodeDeploy. The deployment is defined by the following `appspec.yml` template fragment:

yaml
version: 0.0
Resources:
- MyLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "MyLambdaFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"

The developer needs to modify this configuration to execute a validation Lambda function before traffic shifting begins, and must configure the CodeDeploy service role with the correct trust relationship and permissions.

Which two actions should the developer take to meet these requirements? (Select TWO.)

  1. In the AppSpec file, add a Hooks section under the root level and configure the BeforeAllowTraffic lifecycle event to point to the validation Lambda function.Answer
  2. Configure the IAM service role used by AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role, and attach the AWSCodeDeployRoleForLambda managed policy.Answer
  3. C
    In the AppSpec file, add a hooks section under the root level and configure the BeforeInstall lifecycle event to run a shell script that performs validation.
  4. D
    Configure the IAM service role used by AWS CodeDeploy with a trust policy that permits lambda.amazonaws.com to assume the role.
  5. E
    Configure the validation Lambda function to retrieve database credentials from AWS Systems Manager Parameter Store with automatic rotation enabled.

Answer

Add a Hooks section with BeforeAllowTraffic pointing to the validation Lambda function, and configure the IAM service role for AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role.
For AWS Lambda deployments, the AppSpec file uses the 'Hooks' section to trigger Lambda functions during lifecycle events. The 'BeforeAllowTraffic' event runs validation functions before the traffic shifting begins. Additionally, AWS CodeDeploy requires an IAM service role with a trust policy that allows the 'codedeploy.amazonaws.com' service to assume the role via 'sts:AssumeRole' so it can execute deployments on your behalf.

Step-by-Step Solution

1
Identify the correct AppSpec schema and lifecycle hooks for AWS Lambda deployments.
Confirm that the 'Hooks' section is used at the root level and 'BeforeAllowTraffic' is the valid event to run validation tests before shifting traffic.
Ensure validation logic is executed at the correct lifecycle stage for serverless deployments.
2
Configure the IAM trust policy for the CodeDeploy service role.
Ensure the trust policy allows the 'codedeploy.amazonaws.com' service to assume the role.
Allows AWS CodeDeploy to assume the role and execute the deployment operations.
3
Verify credentials storage and rotation configuration.
Avoid choosing Parameter Store for secrets that require native automatic rotation capabilities.
Avoid common configuration mistakes related to credential security.

Key Concept

AWS CodeDeploy Lambda Deployment Lifecycle Hooks and Service Role configuration
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic