Examkin

Question

Difficulty: HardAWS CodeDeploy

An organization is transitioning a containerized API from Amazon EC2 to Amazon ECS and implementing blue/green deployments using AWS CodeDeploy. A developer must configure the deployment to execute an AWS Lambda function named "ValidateDeployment" to run smoke tests on the replacement task set after it is provisioned but before any traffic is routed to it. The validation Lambda function must also retrieve database credentials from AWS Secrets Manager during its run. Which configuration represents the correct setup for the AppSpec file and the required IAM roles to support this deployment?

  1. A
    Use an AppSpec file with lowercase resources and hooks sections, defining the Lambda function ARN under hooks as `- AfterInstall: "arn:aws:lambda:us-east-1:123456789012:function:ValidateDeployment"`. Configure the Amazon ECS Task Execution Role with a trust policy for ecs-tasks.amazonaws.com, and grant it AWS Secrets Manager retrieve permissions.
  2. B
    Use an AppSpec file with capitalized Resources and Hooks sections, defining the Lambda function ARN under Hooks as `- AfterInstall: "arn:aws:lambda:us-east-1:123456789012:function:ValidateDeployment"`. Configure the CodeDeploy service role to trust codedeploy.amazonaws.com. Grant the CodeDeploy service role permissions to retrieve the database credentials from Amazon Systems Manager Parameter Store, as CodeDeploy will retrieve and inject the credentials.
  3. Use an AppSpec file with capitalized Resources and Hooks sections, defining the Lambda function ARN under Hooks as `- AfterInstall: "arn:aws:lambda:us-east-1:123456789012:function:ValidateDeployment"`. Configure the AWS CodeDeploy service role with a trust policy that allows codedeploy.amazonaws.com to assume the role. Grant the validation Lambda function's execution role permission to retrieve the database credentials from AWS Secrets Manager.Answer
  4. D
    Use an AppSpec file with lowercase files and hooks sections, defining a shell script under hooks as `- ApplicationStart: "scripts/validate.sh"`. Configure the Amazon EC2 Instance Profile role to trust codedeploy.amazonaws.com. Grant the EC2 Instance Profile role permission to retrieve the database credentials from AWS Secrets Manager.

Answer

The correct configuration is to use capitalized Resources and Hooks sections in the AppSpec file, define the validation Lambda function under the AfterInstall hook, configure the AWS CodeDeploy service role to trust codedeploy.amazonaws.com, and grant the validation Lambda function's IAM execution role permission to retrieve the credentials from AWS Secrets Manager.
The correct option correctly identifies that for ECS deployments, the AppSpec file must contain capitalized Resources and Hooks sections, and the validation hook must be a Lambda function defined under a valid ECS hook like AfterInstall. It also correctly specifies that the CodeDeploy service role trust policy must trust codedeploy.amazonaws.com, and the validation Lambda function's execution role must be granted Secrets Manager permissions to retrieve database credentials.

Step-by-Step Solution

1
Identify the AppSpec syntax requirements for ECS deployments.
The AppSpec file must use capitalized Resources and Hooks keys, and the lifecycle hooks must invoke AWS Lambda functions rather than shell scripts.
ECS and Lambda deployments in CodeDeploy utilize a different schema structure than EC2/On-Premises deployments, requiring capitalized keys and Lambda function targets.
2
Determine the correct CodeDeploy lifecycle hook for validation before traffic routing.
AfterInstall runs after the replacement task set is created but before traffic routing starts.
This ensures validation is completed before the production listener shifts traffic to the new task set.
3
Identify the required IAM configurations for CodeDeploy and the validation hook.
The CodeDeploy service role must trust codedeploy.amazonaws.com. The validation Lambda function's IAM execution role must have permissions to assume lambda.amazonaws.com and must be granted secretsmanager:GetSecretValue permissions.
CodeDeploy needs to assume its own service role to execute the deployment, and the Lambda function executes under its own role to retrieve the secrets directly.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks and IAM configuration requirements for Amazon ECS blue/green deployments.
Estimated Time:2m 30s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic