Examkin

Question

Difficulty: MediumAWS CodeDeploy

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. During the deployment process, the deployment fails with an access denied error because CodeDeploy is unable to modify the Application Load Balancer listeners and target groups. The developer verifies that the CodeDeploy service role has the AWSCodeDeployRoleForECS managed policy attached. Which configuration must the developer verify or update to resolve this deployment failure?

  1. The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.Answer
  2. B
    The permission policy of the ECS Task Execution Role, ensuring it explicitly grants the sts:AssumeRole permission for the CodeDeploy service role.
  3. C
    The IAM trust policy of the ECS Task Role, ensuring it lists the CodeDeploy service principal as a trusted entity.
  4. D
    The configurations in AWS Systems Manager Parameter Store, ensuring the CodeDeploy service role ARN is stored as a SecureString parameter and referenced in the AppSpec file.

Answer

The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.
The trust policy of an IAM role defines which principal (such as an AWS service or another account) is allowed to assume the role. For AWS CodeDeploy to perform deployment actions on behalf of the developer (such as updating ECS target groups), its service role's trust policy must trust the CodeDeploy service principal (codedeploy.amazonaws.com) and allow the sts:AssumeRole action. If this trust policy is missing or misconfigured, CodeDeploy cannot assume the role, resulting in an access denied error even if the role has the correct permissions attached.

Step-by-Step Solution

1
Analyze the deployment error and identify that CodeDeploy failed to assume the service role despite the correct permissions policy being attached.
Recognize that the failure is related to IAM role delegation/trust rather than the permissions policy contents.
CodeDeploy must be trusted by the service role before it can assume it to perform deployment tasks on ECS resources.
2
Locate the CodeDeploy service role in the IAM console and inspect its trust relationships (trust policy).
Determine that the trust policy must explicitly allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
Without this trust policy, AWS Security Token Service (STS) will deny the assume role request, causing CodeDeploy to fail with an access denied error.

Key Concept

AWS CodeDeploy Service Role Trust Policy
Estimated Time:1m 30s
Rate this question

Topics

AWS CodeDeploy

More questions from this topic