Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is setting up an AWS CodeDeploy deployment group for an in-place deployment of a web application to a fleet of Amazon EC2 instances. The deployment fails during the DownloadBundle phase because the CodeDeploy agent on the EC2 instances cannot access the deployment bundle in the Amazon S3 bucket. Additionally, the developer needs to store database credentials securely and retrieve them during the deployment process rather than packaging them in the deployment bundle.

Which two actions should the developer take to resolve these issues? (Select TWO.)

  1. Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle.Answer
  2. Store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, and write a script in the AppSpec BeforeInstall hook to retrieve them.Answer
  3. C
    Attach an IAM policy to the CodeDeploy service role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle.
  4. D
    Configure the trust policy of the CodeDeploy service role to allow the ec2.amazonaws.com service to assume the role.
  5. E
    Store the database credentials as plaintext parameters in AWS Systems Manager Parameter Store, and write a script in the AppSpec AfterAllowTraffic hook to retrieve them.

Answer

Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle, and store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, retrieving them in the AppSpec BeforeInstall hook.
The correct options involve configuring the EC2 instance profile role with the appropriate S3 read permissions so the CodeDeploy agent can download the bundle, and securely storing credentials in Systems Manager Parameter Store as SecureString parameters, retrieving them during a valid EC2 lifecycle hook like BeforeInstall.

Step-by-Step Solution

1
Analyze the cause of the CodeDeploy agent S3 access failure.
The agent runs on the EC2 instances and uses the instance profile role to download the deployment bundle. S3 permissions must be granted to the instance profile role, not the CodeDeploy service role.
Permissions must align with the identity executing the action, which is the CodeDeploy agent on EC2.
2
Determine the secure method and correct lifecycle hook for credential retrieval on EC2.
Store credentials as SecureString parameters in AWS Systems Manager Parameter Store and retrieve them using a lifecycle hook valid for EC2, such as BeforeInstall.
This avoids plaintext storage and uses a hook that is compatible with EC2 in-place deployments.

Key Concept

AWS CodeDeploy permissions and AppSpec configuration on EC2
Rate this question

Topics

AWS CodeDeploy

More questions from this topic