A developer is configuring a canary deployment for an AWS Lambda function using AWS CodeDeploy. The deployment must run a test Lambda function to validate the deployment before shifting traffic, and another test Lambda function to run post-deployment validation checks after all traffic has been shifted to the new version. Which two configuration steps must the developer perform to meet these requirements?
- Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file.Answer
- Attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions, and ensure its trust policy allows the codedeploy.amazonaws.com service principal.Answer
- CDefine the validation Lambda functions under the BeforeInstall and AfterInstall hooks in the AppSpec file.
- DModify the trust policy of the validation Lambda functions' execution role to allow codedeploy.amazonaws.com to assume the role.
- EStore the validation Lambda function ARNs in AWS Secrets Manager and reference them in the resources section of the AppSpec file to dynamically retrieve them during deployment.
Answer
Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file, and attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions while ensuring its trust policy allows the codedeploy.amazonaws.com service principal.
The correct options properly configure the deployment lifecycle hooks for AWS Lambda (BeforeAllowTraffic and AfterAllowTraffic) in the AppSpec file and grant the required invoke permissions to the CodeDeploy service role.
Step-by-Step Solution
Key Concept
AWS CodeDeploy lifecycle hooks for Lambda deployments and their associated IAM permissions.