Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is setting up an in-place deployment of a web application to Amazon EC2 instances using AWS CodeDeploy. The application revision bundle is stored in a private Amazon S3 bucket. During the deployment, the process fails during the DownloadBundle lifecycle event with an Access Denied error. Which action should the developer take to resolve this failure?

  1. A
    Grant s3:GetObject permissions for the S3 bucket to the CodeDeploy service role associated with the deployment group.
  2. B
    Define a validation script under the BeforeAllowTraffic lifecycle hook in the appspec.yml file to manually pull the bundle from S3.
  3. Attach an IAM role that grants s3:GetObject permissions for the S3 bucket to the IAM instance profile of the EC2 instances.Answer
  4. D
    Store the S3 bucket credentials in Systems Manager Parameter Store and write a script in the BeforeInstall hook to retrieve them to download the bundle.

Answer

Attach an IAM role that grants s3:GetObject permissions for the S3 bucket to the IAM instance profile of the EC2 instances.
The correct answer is to attach an IAM role with S3 read permissions to the EC2 instances' instance profile. In AWS CodeDeploy, the CodeDeploy agent runs directly on the EC2 instances. During the DownloadBundle deployment lifecycle event, this agent pulls the application revision bundle from Amazon S3. To authorize this request, the agent utilizes the permissions from the instance profile attached to the EC2 instance, not the CodeDeploy service role.

Step-by-Step Solution

1
Identify which component is downloading the application revision.
The CodeDeploy agent running locally on the Amazon EC2 instances downloads the application revision bundle from the specified Amazon S3 bucket.
Understanding which entity performs the action helps determine which IAM identity needs the permission.
2
Determine the credential source for the CodeDeploy agent.
The CodeDeploy agent uses the permissions attached to the EC2 instance's IAM instance profile.
Since the agent runs on the instance, it relies on the EC2 instance profile to authenticate and authorize its requests to other AWS services like Amazon S3.
3
Grant the minimum required S3 permission to the EC2 instance profile.
Add an IAM policy granting s3:GetObject permissions for the target S3 bucket to the role associated with the EC2 instance profile.
This allows the agent to fetch the bundle successfully during the DownloadBundle event.

Key Concept

CodeDeploy Agent Credentials and EC2 Instance Profiles
Rate this question

Topics

AWS CodeDeploy

More questions from this topic