Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is setting up a deployment pipeline to update a serverless application. The developer is configuring AWS CodeDeploy to perform a Canary deployment of an AWS Lambda function. The deployment process must execute a test Lambda function to validate the deployment before any production traffic is shifted to the new version. Additionally, the CodeDeploy service must be granted the minimal permissions required to orchestrate the deployment on behalf of the developer.

Which configuration steps must the developer perform to meet these requirements? (Select TWO.)

  1. In the appspec.yaml file, define the validation function name under the BeforeAllowTraffic hook within the Hooks section.Answer
  2. Attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume the role.Answer
  3. C
    In the appspec.yaml file, specify the validation script path under the BeforeInstall hook within the Hooks section.
  4. D
    Attach a trust policy to the Lambda execution role that permits codedeploy.amazonaws.com to assume the role directly.
  5. E
    Configure the validation function to retrieve its runtime secrets directly from the Systems Manager Parameter Store with rotation enabled via CodeDeploy.

Answer

To configure the deployment, the developer must define the validation function under the BeforeAllowTraffic hook in the appspec.yaml file, and attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume it.
The correct configurations involve using the BeforeAllowTraffic lifecycle hook in the appspec.yaml file to run a validation Lambda function before traffic shifting begins, and setting up an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role. This permits CodeDeploy to invoke the validation function and orchestrate the deployment.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec lifecycle hook for Lambda deployments.
The BeforeAllowTraffic lifecycle hook is identified as the correct place to run a validation Lambda function before traffic is shifted.
For Lambda deployments, CodeDeploy only supports BeforeAllowTraffic and AfterAllowTraffic hooks, and they must point to validation Lambda functions.
2
Identify the required IAM configuration for the CodeDeploy service role.
A service role with a trust policy allowing codedeploy.amazonaws.com to assume the role is required.
CodeDeploy needs permissions to perform actions (like shifting traffic and invoking validation functions) on your behalf, which is accomplished by assuming the service role.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks and IAM service roles for Lambda deployments.
Estimated Time:2m 0s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic