Examkin

Question

Difficulty: Very hardAWS CodeDeploy

A company is deploying a containerized microservice to Amazon ECS on AWS Fargate using a blue/green deployment managed by AWS CodeDeploy. The deployment must run a database schema migration script before production traffic is routed to the new task set, and it must execute post-deployment integration tests once the traffic routing is complete. Additionally, the deployment process must have the necessary permissions to interact with ECS and Lambda. Which TWO options represent the correct configuration steps required for this deployment?

  1. Configure the AppSpec file with a BeforeAllowTraffic lifecycle hook pointing to a Lambda function that runs the database migration, and an AfterAllowTraffic hook pointing to a Lambda function that executes the post-deployment tests.Answer
  2. Configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.Answer
  3. C
    Configure the AppSpec file with a BeforeInstall lifecycle hook referencing a shell script path to execute the database migrations directly inside the target ECS containers.
  4. D
    Add the sts:AssumeRole permission directly to the CodeDeploy service role's identity-based permissions policy to allow CodeDeploy to assume the ECS task execution role.
  5. E
    Store the database credentials in Systems Manager Parameter Store as a SecureString and enable the built-in Parameter Store automatic rotation feature to rotate the password before the BeforeAllowTraffic hook runs.

Answer

Configure the AppSpec file with a BeforeAllowTraffic hook pointing to a Lambda function to run the database migration and an AfterAllowTraffic hook pointing to a Lambda function for post-deployment tests, and configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct configurations involve using ECS-compatible AppSpec hooks (BeforeAllowTraffic and AfterAllowTraffic invoking Lambda functions) and establishing the correct trust relationship on the CodeDeploy service role (trusting codedeploy.amazonaws.com to perform sts:AssumeRole).

Step-by-Step Solution

1
Analyze the target compute platform and the required hooks.
Since the target platform is Amazon ECS, CodeDeploy lifecycle hooks must invoke AWS Lambda functions rather than executing local shell scripts.
ECS AppSpec syntax specifies Lambda functions for hooks, whereas EC2 AppSpec supports shell script execution.
2
Determine the correct sequencing for database migrations and post-deployment validation.
Migrations must happen before production traffic shifts (BeforeAllowTraffic), and integration tests must run after traffic shifts completely (AfterAllowTraffic).
Running migrations after traffic shifts would cause errors on the new task set, and tests must validate the live production traffic state.
3
Establish the necessary IAM authorization for CodeDeploy.
Configure a trust policy (trust relationship) on the CodeDeploy service role to allow the service principal codedeploy.amazonaws.com to assume it.
A trust policy is required for AWS services to assume a role and perform actions on resources in your account.

Key Concept

AWS CodeDeploy ECS Deployment Lifecycle Hooks and IAM Service Role Configuration
Rate this question

Topics

AWS CodeDeploy

More questions from this topic