Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring a blue/green deployment for an Amazon ECS application using AWS CodeDeploy. The deployment must execute validation tests on the green task set after it starts but before production traffic is directed to it. In addition, the developer must ensure that AWS CodeDeploy has the correct permissions to perform the deployment. Which two configurations must the developer implement to satisfy these requirements? (Select TWO.)

  1. In the AppSpec file, specify an AWS Lambda function under the AfterAllowTestTraffic lifecycle hook to perform validation tests on the green task set.Answer
  2. Configure the AWS IAM service role for CodeDeploy with a trust policy that allows the service principal codedeploy.amazonaws.com to assume the role.Answer
  3. C
    Define a shell script path under the AfterInstall hook in the AppSpec file to execute the validation tests directly on the container instances.
  4. D
    Configure the CodeDeploy service role with a trust policy that permits the ec2.amazonaws.com service principal to assume the role.
  5. E
    Store the database credentials for the validation tests in AWS Systems Manager Parameter Store and enable the native automated rotation feature for the parameter.

Answer

To configure validation testing and permissions for an ECS blue/green deployment, the developer must specify an AWS Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role.
For validation testing on Amazon ECS, the AppSpec file must define an AWS Lambda function under the AfterAllowTestTraffic hook, allowing testing on the green task set before production traffic is routed. Furthermore, CodeDeploy needs a service role with a trust policy that designates the codedeploy.amazonaws.com service principal as an allowed entity to assume the role.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec hook for validation testing before shifting production traffic in ECS.
Identify the AfterAllowTestTraffic lifecycle hook.
This hook executes after traffic is directed to the test port on the green task set, allowing validation tests to run prior to the production traffic shift.
2
Select the correct executor type for ECS AppSpec lifecycle hooks.
Use an AWS Lambda function for the lifecycle hook.
Unlike EC2 deployments, CodeDeploy hook executions for ECS and Lambda deployments only support invoking an AWS Lambda function, not executing custom shell scripts.
3
Configure the IAM trust policy for the CodeDeploy service role.
Add codedeploy.amazonaws.com as the principal in the AssumeRole policy statement.
This allows CodeDeploy to assume the service role and make API calls to update the ECS service and shift traffic on behalf of the developer.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for ECS and the trust policy required for the CodeDeploy service role.
Rate this question

Topics

AWS CodeDeploy

More questions from this topic