Examkin

AWS CodeDeploy

48 questions

All types48Multiple choice25Multiple select23
Question 1Question →

A developer is configuring an AWS CodeDeploy deployment group for an in-place deployment of a web application to Amazon EC2 instances. The deployment must automatically revert to the last known successful version if the new deployment fails or if application error rates exceed a specific threshold. Additionally, the developer needs to ensure that any temporary files left by a failed deployment are cleaned up during the rollback process.

Which of the following configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures, and configure a CloudWatch alarm to trigger a rollback when application error rates exceed the threshold.; Implement the cleanup script within the BeforeInstall lifecycle hook of the application's AppSpec file, because CodeDeploy rolls back by executing a new deployment of the last successful revision.

Answer

Enable automatic rollbacks in the CodeDeploy deployment group settings for deployment failures and CloudWatch alarm states, and implement cleanup logic in the BeforeInstall hook of the AppSpec file because CodeDeploy performs a rollback by initiating a new deployment of the last successful revision.
The correct configurations are to enable automatic rollbacks in the CodeDeploy deployment group for both deployment failures and when a configured CloudWatch alarm (tracking error rates) goes into the ALARM state. Furthermore, because CodeDeploy executes a rollback by initiating a new deployment of the last successful revision, the cleanup logic must be placed in a standard lifecycle hook such as BeforeInstall of that revision to ensure any leftover artifacts from the failed deployment are deleted before files are copied.

Step-by-Step Solution

1
Configure rollback behaviors on the deployment group
Automatic rollbacks are enabled for deployment failures and CloudWatch alarms monitoring error rate thresholds.
This natively automates the rollback process when a failure is detected or when application metrics degrade.
2
Analyze how CodeDeploy executes rollbacks
CodeDeploy handles rollbacks by running a brand new deployment of the previous successful revision.
Understanding this flow reveals that there is no custom Rollback hook; instead, standard deployment hooks in the target revision will run.
3
Place the cleanup script in the correct lifecycle hook of the AppSpec file
The cleanup script is mapped to the BeforeInstall hook of the AppSpec file.
When the rollback deployment starts, the BeforeInstall hook runs before new files are copied, clearing out remnants of the failed deployment.

Key Concept

AWS CodeDeploy rollbacks are executed as new deployments of the last known successful revision, which run the standard AppSpec lifecycle hooks of that revision rather than a dedicated rollback hook.
Question 2Question →

A developer is setting up an AWS CodeDeploy deployment group for an in-place deployment of a web application to a fleet of Amazon EC2 instances. The deployment fails during the DownloadBundle phase because the CodeDeploy agent on the EC2 instances cannot access the deployment bundle in the Amazon S3 bucket. Additionally, the developer needs to store database credentials securely and retrieve them during the deployment process rather than packaging them in the deployment bundle.

Which two actions should the developer take to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle.; Store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, and write a script in the AppSpec BeforeInstall hook to retrieve them.

Answer

Attach an IAM policy to the EC2 instance profile role that allows the s3:GetObject action on the S3 bucket containing the deployment bundle, and store the database credentials as SecureString parameters in AWS Systems Manager Parameter Store, retrieving them in the AppSpec BeforeInstall hook.
The correct options involve configuring the EC2 instance profile role with the appropriate S3 read permissions so the CodeDeploy agent can download the bundle, and securely storing credentials in Systems Manager Parameter Store as SecureString parameters, retrieving them during a valid EC2 lifecycle hook like BeforeInstall.

Step-by-Step Solution

1
Analyze the cause of the CodeDeploy agent S3 access failure.
The agent runs on the EC2 instances and uses the instance profile role to download the deployment bundle. S3 permissions must be granted to the instance profile role, not the CodeDeploy service role.
Permissions must align with the identity executing the action, which is the CodeDeploy agent on EC2.
2
Determine the secure method and correct lifecycle hook for credential retrieval on EC2.
Store credentials as SecureString parameters in AWS Systems Manager Parameter Store and retrieve them using a lifecycle hook valid for EC2, such as BeforeInstall.
This avoids plaintext storage and uses a hook that is compatible with EC2 in-place deployments.

Key Concept

AWS CodeDeploy permissions and AppSpec configuration on EC2
Question 3Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation Lambda function after the test traffic is routed to the replacement task set but before the production traffic is shifted. Additionally, the developer must ensure that AWS CodeDeploy has the necessary permissions to execute the deployment steps and update the Application Load Balancer listeners. Which of the following configurations must the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the AppSpec file, specify the validation Lambda function under the AfterAllowTestTraffic hook in the Hooks section.; Configure the trust policy of the CodeDeploy service IAM role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

In the AppSpec file, specify the validation Lambda function under the AfterAllowTestTraffic hook in the Hooks section, and configure the trust policy of the CodeDeploy service IAM role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct configurations involve using the AfterAllowTestTraffic hook in the ECS AppSpec file to trigger the validation Lambda function after test traffic routing, and configuring the CodeDeploy service IAM role trust policy to allow codedeploy.amazonaws.com to assume the role. These steps ensure CodeDeploy has the authority to orchestrate the deployment and execute verification tests at the correct stage.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec lifecycle hook for validating an Amazon ECS blue/green deployment before production traffic is shifted.
Identify that AfterAllowTestTraffic is the designated hook that runs validation tests after the test traffic is routed to the new task set.
This hook provides a window to verify the health and behavior of the new version using test traffic before exposing it to live production users.
2
Examine the IAM configurations required for CodeDeploy to assume a service role and manage ECS and ALB resources.
Identify that the CodeDeploy service IAM role must have a trust policy configured with the codedeploy.amazonaws.com principal and the sts:AssumeRole action.
This trust policy allows the AWS CodeDeploy service to securely assume the role and perform administrative actions on behalf of the developer.

Key Concept

AWS CodeDeploy for Amazon ECS uses a specific set of lifecycle hooks in the AppSpec file (such as AfterAllowTestTraffic) and requires an IAM service role with a trust policy for the codedeploy.amazonaws.com service principal.
Question 4Question →

A developer is configuring AWS CodeDeploy to deploy a Python web application to a fleet of Amazon EC2 instances. The deployment process must retrieve database credentials securely from AWS Systems Manager Parameter Store (stored as a `SecureString` parameter) and execute a database migration script before the application starts and begins accepting traffic.

Which two actions must the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Grant the Amazon EC2 instance profile IAM role the `ssm:GetParameters` and `kms:Decrypt` permissions.; Execute the database migration script during the `AfterInstall` lifecycle hook in the `appspec.yml` file.

Answer

Granting the Amazon EC2 instance profile IAM role the necessary decrypt permissions and executing the migration script during the AfterInstall lifecycle hook in the appspec.yml file.
To successfully run the database migration before the application starts, the script must execute during a valid EC2 lifecycle hook like `AfterInstall`. Since the script runs on the EC2 instances, the instance profile IAM role must have permissions to retrieve the SecureString parameter and decrypt it using the associated KMS key.

Step-by-Step Solution

1
Identify the entity executing the deployment scripts.
The CodeDeploy agent runs on the EC2 instances and executes the AppSpec lifecycle hook scripts.
This determines that permissions to fetch parameters must be assigned to the EC2 instance profile role, not the CodeDeploy service role.
2
Select the correct CodeDeploy lifecycle hook for EC2.
The `AfterInstall` hook runs on EC2 instances before the application starts.
This ensures the schema migration is completed before the web server begins running.
3
Grant the EC2 instance profile access to Systems Manager Parameter Store and AWS KMS.
Add `ssm:GetParameters` and `kms:Decrypt` to the instance profile role's policy.
The script running on the instance must be authorized to pull and decrypt the database credentials.

Key Concept

AWS CodeDeploy EC2 deployments rely on the CodeDeploy agent running under the instance profile's IAM permissions and execute scripts within EC2-specific lifecycle hooks such as AfterInstall.
Estimated Time:2m 0s
Question 5Question →

A developer is setting up an in-place deployment of a web application to Amazon EC2 instances using AWS CodeDeploy. The application revision bundle is stored in a private Amazon S3 bucket. During the deployment, the process fails during the DownloadBundle lifecycle event with an Access Denied error. Which action should the developer take to resolve this failure?

Show answer & explanation

Answer: Attach an IAM role that grants s3:GetObject permissions for the S3 bucket to the IAM instance profile of the EC2 instances.

Answer

Attach an IAM role that grants s3:GetObject permissions for the S3 bucket to the IAM instance profile of the EC2 instances.
The correct answer is to attach an IAM role with S3 read permissions to the EC2 instances' instance profile. In AWS CodeDeploy, the CodeDeploy agent runs directly on the EC2 instances. During the DownloadBundle deployment lifecycle event, this agent pulls the application revision bundle from Amazon S3. To authorize this request, the agent utilizes the permissions from the instance profile attached to the EC2 instance, not the CodeDeploy service role.

Step-by-Step Solution

1
Identify which component is downloading the application revision.
The CodeDeploy agent running locally on the Amazon EC2 instances downloads the application revision bundle from the specified Amazon S3 bucket.
Understanding which entity performs the action helps determine which IAM identity needs the permission.
2
Determine the credential source for the CodeDeploy agent.
The CodeDeploy agent uses the permissions attached to the EC2 instance's IAM instance profile.
Since the agent runs on the instance, it relies on the EC2 instance profile to authenticate and authorize its requests to other AWS services like Amazon S3.
3
Grant the minimum required S3 permission to the EC2 instance profile.
Add an IAM policy granting s3:GetObject permissions for the target S3 bucket to the role associated with the EC2 instance profile.
This allows the agent to fetch the bundle successfully during the DownloadBundle event.

Key Concept

CodeDeploy Agent Credentials and EC2 Instance Profiles
Question 6Question →

A developer is performing an in-place deployment of a new application revision to a fleet of Amazon EC2 instances using AWS CodeDeploy. The developer updated a cleanup script named 'stop-server.sh' in the new revision and referenced it in the 'ApplicationStop' lifecycle hook of the 'appspec.yml' file. However, the deployment fails during the 'ApplicationStop' phase. Investigation reveals that the 'stop-server.sh' script currently residing on the instances (from the previous deployment) has a syntax error that causes it to exit with a non-zero status, whereas the updated script in the new deployment bundle has this error fixed. Which of the following explains why the deployment failed and how the developer can successfully deploy the new application revision?

Show answer & explanation

Answer: CodeDeploy executes the 'ApplicationStop' hook using the script from the previously deployed revision on the instances. The developer can bypass this failure by redeploying the new revision with the ignore application stop failures option enabled.

Answer

CodeDeploy executes the ApplicationStop hook using the script from the previously deployed revision on the instances. The developer can bypass this failure by redeploying the new revision with the ignore application stop failures option enabled.
The correct option is correct because during an in-place deployment, CodeDeploy runs the ApplicationStop lifecycle hook using the scripts and appspec.yml from the previous successful deployment revision. Since the script on the instances has a bug, the hook fails and prevents the deployment from proceeding. Enabling the ignore application stop failures option allows CodeDeploy to bypass this hook's failure and successfully deploy the new version.

Step-by-Step Solution

1
Analyze the execution context of lifecycle hooks in an in-place CodeDeploy deployment.
Identify that the ApplicationStop hook occurs before the new revision bundle is downloaded and runs using the appspec.yml and scripts from the previously successful deployment revision.
This explains why the syntax error in the old version of the script causes the new deployment to fail, even though the script is fixed in the new revision bundle.
2
Evaluate recovery mechanisms for failing ApplicationStop scripts in CodeDeploy.
Determine that CodeDeploy allows bypassing ApplicationStop script failures using the '--ignore-application-stop-failures' flag in the AWS CLI or by checking the equivalent option in the AWS Management Console.
Since the local script on the EC2 instances is broken and cannot exit successfully, bypassing the hook is the only automated way to allow the new, fixed bundle to be downloaded and installed.

Key Concept

AWS CodeDeploy EC2 in-place deployment lifecycle hook execution and failure handling
Estimated Time:2m 0s
Question 7Question →

A developer is writing an appspec.yml file for an in-place deployment to Amazon EC2 instances using AWS CodeDeploy. The developer needs to execute a shell script to gracefully stop the running web server application before the new deployment bundle is downloaded. Additionally, the script requires retrieving database credentials that must undergo automatic rotation. How should the developer configure the deployment to meet these requirements?

Show answer & explanation

Answer: Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.

Answer

Specify the script under the ApplicationStop lifecycle hook in the appspec.yml file, and retrieve the credentials dynamically from AWS Secrets Manager using the AWS CLI within the script.
The correct configuration is to target the ApplicationStop lifecycle hook. In an EC2 in-place deployment, ApplicationStop is the first hook to execute and runs before the new deployment bundle is downloaded (DownloadBundle phase). Additionally, AWS Secrets Manager is the correct service for retrieving the rotated database credentials, as it natively supports automatic rotation of secrets, unlike Systems Manager Parameter Store.

Step-by-Step Solution

1
Determine the correct CodeDeploy lifecycle hook for EC2 that runs before downloading files.
The ApplicationStop hook is identified as the first lifecycle event in an EC2 deployment, executing prior to the DownloadBundle event.
Running the shutdown script during ApplicationStop ensures the web server is stopped before the new package is downloaded or copied.
2
Select the appropriate secrets service that supports automatic rotation.
AWS Secrets Manager is chosen instead of Systems Manager Parameter Store.
AWS Secrets Manager provides built-in, automated credential rotation, meeting the security rotation requirement directly.
3
Configure the script to retrieve the secret at runtime.
The shell script uses the AWS CLI to fetch the secrets from Secrets Manager dynamically using the permissions assigned to the EC2 instance profile.
This avoids hardcoding credentials in the appspec.yml or deployment bundle, maintaining compliance with security best practices.

Key Concept

CodeDeploy EC2 Deployment Lifecycle Hooks and Secrets Management
Estimated Time:1m 30s
Question 8Question →

A developer is configuring an AWS CodeDeploy blue/green deployment for a microservice on Amazon ECS. The deployment must execute a validation Lambda function named `run-integration-tests` immediately after the load balancer routes test traffic to the replacement task set, but before production traffic is shifted. Additionally, the Lambda function needs to retrieve a database credential that must be rotated automatically every 30 days.

Here is a snippet of the AppSpec file being used:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/api-service:2"
LoadBalancerInfo:
ContainerName: "api"
ContainerPort: 8080
Hooks:
- <HOOK_NAME>: "arn:aws:lambda:us-east-1:123456789012:function:run-integration-tests"

Which combination of CodeDeploy lifecycle hook and AWS service configuration will satisfy these requirements?

Show answer & explanation

Answer: Hook: AfterAllowTestTraffic; Service: AWS Secrets Manager

Answer

Hook: AfterAllowTestTraffic; Service: AWS Secrets Manager
The correct configuration uses the AfterAllowTestTraffic hook to trigger the validation Lambda function. In an Amazon ECS deployment, AfterAllowTestTraffic runs after the test listener starts routing traffic to the replacement task set, allowing validation tests to execute before production traffic is shifted. Storing the database password in AWS Secrets Manager is correct because Secrets Manager natively supports automatic rotation of secrets (such as database credentials), whereas Systems Manager Parameter Store does not provide built-in automatic rotation.

Step-by-Step Solution

1
Identify the target deployment platform and the phase where validation tests must run.
The target platform is Amazon ECS. To validate the replacement tasks using test traffic before production traffic is routed, the AfterAllowTestTraffic hook must be used.
AfterAllowTestTraffic executes immediately after test traffic begins routing to the replacement task set, providing the correct window for integration tests.
2
Determine the service to store the database credential based on the security requirements.
AWS Secrets Manager is selected because the database credential requires automatic rotation.
AWS Secrets Manager supports built-in automatic rotation for database credentials, while Systems Manager Parameter Store is primarily for configuration management and does not support native automatic rotation.
3
Validate the IAM service role trust policy requirements for CodeDeploy.
The CodeDeploy service role must allow the 'codedeploy.amazonaws.com' service principal to assume the role.
Configuring the trust policy for 'ecs.amazonaws.com' instead of 'codedeploy.amazonaws.com' will prevent CodeDeploy from assuming the role to perform the deployment.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for Amazon ECS and credential rotation using AWS Secrets Manager.
Estimated Time:1m 30s
Question 9Question →

A developer is configuring a blue/green deployment for an application on Amazon ECS using AWS CodeDeploy. The deployment must execute a validation test suite to verify the application's health using a test traffic port before the production traffic is routed to the new task set. Additionally, CodeDeploy must be configured with the necessary permissions to manage the ECS deployment. Which of the following configurations must the developer perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define a validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.; Configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

Define a validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct options involve configuring the AfterAllowTestTraffic lifecycle hook in the AppSpec file to invoke a validation Lambda function on the test port, and setting up the CodeDeploy service role's trust policy to allow the codedeploy.amazonaws.com service principal to assume it.

Step-by-Step Solution

1
Identify the correct AppSpec lifecycle hook for Amazon ECS validation tests.
Determine that the AfterAllowTestTraffic hook is executed after the test traffic port is directed to the replacement task set, which is the correct time to run validation tests.
ECS deployments use specific hooks like AfterAllowTestTraffic to validate the replacement task set using a test port before moving production traffic.
2
Establish the necessary IAM permissions for CodeDeploy to perform the deployment.
Identify that the CodeDeploy service role must have a trust policy allowing the codedeploy.amazonaws.com service principal to assume the role.
Without this trust policy, CodeDeploy will fail to assume the role and will not be able to interact with Amazon ECS to manage the deployment.

Key Concept

AWS CodeDeploy ECS Deployment Configuration
Question 10Question →

A developer is setting up a deployment pipeline to update a serverless application. The developer is configuring AWS CodeDeploy to perform a Canary deployment of an AWS Lambda function. The deployment process must execute a test Lambda function to validate the deployment before any production traffic is shifted to the new version. Additionally, the CodeDeploy service must be granted the minimal permissions required to orchestrate the deployment on behalf of the developer.

Which configuration steps must the developer perform to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the appspec.yaml file, define the validation function name under the BeforeAllowTraffic hook within the Hooks section.; Attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume the role.

Answer

To configure the deployment, the developer must define the validation function under the BeforeAllowTraffic hook in the appspec.yaml file, and attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume it.
The correct configurations involve using the BeforeAllowTraffic lifecycle hook in the appspec.yaml file to run a validation Lambda function before traffic shifting begins, and setting up an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role. This permits CodeDeploy to invoke the validation function and orchestrate the deployment.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec lifecycle hook for Lambda deployments.
The BeforeAllowTraffic lifecycle hook is identified as the correct place to run a validation Lambda function before traffic is shifted.
For Lambda deployments, CodeDeploy only supports BeforeAllowTraffic and AfterAllowTraffic hooks, and they must point to validation Lambda functions.
2
Identify the required IAM configuration for the CodeDeploy service role.
A service role with a trust policy allowing codedeploy.amazonaws.com to assume the role is required.
CodeDeploy needs permissions to perform actions (like shifting traffic and invoking validation functions) on your behalf, which is accomplished by assuming the service role.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks and IAM service roles for Lambda deployments.
Estimated Time:2m 0s
Question 11Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation test against the newly deployed tasks (the green task set) before any production traffic is shifted. If the validation test fails, the deployment must automatically roll back. The developer is defining the AppSpec file in YAML format and configuring the IAM permissions. Which of the following configurations are required to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define the validation Lambda function ARN under the BeforeAllowTraffic hook in the hooks section of the AppSpec file.; Grant the CodeDeploy service role the lambda:InvokeFunction permission for the validation Lambda function.

Answer

Defining the validation Lambda function ARN under the BeforeAllowTraffic hook and granting the CodeDeploy service role the lambda:InvokeFunction permission.
The correct configurations involve using the BeforeAllowTraffic lifecycle hook inside the ECS AppSpec file to point to the validation Lambda function, and ensuring the CodeDeploy service role has the lambda:InvokeFunction permission to run it. The BeforeAllowTraffic hook executes after the green task set is provisioned but before production traffic shifts, enabling testing and automatic rollback on failure.

Step-by-Step Solution

1
Identify the target compute platform and the required validation timing.
The target platform is Amazon ECS and the validation must run before production traffic is shifted.
This establishes that we must use ECS-compatible AppSpec lifecycle hooks.
2
Determine the correct AppSpec hook and execution format for ECS.
For ECS, AppSpec lifecycle hooks can only target AWS Lambda functions, and the BeforeAllowTraffic hook runs before the production traffic shifts.
This rules out using shell scripts (which are EC2-only) and EC2-specific hooks like ValidateService.
3
Determine the required IAM permissions.
CodeDeploy executes the lifecycle hook, so the CodeDeploy service role requires permission to invoke the validation Lambda function.
This distinguishes it from ECS Task Execution permissions, as the task is not the caller of the validation function.

Key Concept

AWS CodeDeploy ECS Blue/Green lifecycle hooks and IAM permissions
Question 12Question →

A developer is migrating a containerized web application from Amazon EC2 instances to Amazon ECS. The deployment process is managed by AWS CodeDeploy using a Blue/Green deployment configuration. Before production traffic is shifted to the replacement task set, the deployment must execute a database migration script. This script retrieves a database password that must be automatically rotated every 30 days.

The developer writes the following `appspec.yaml` file for the Amazon ECS service:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:111122223333:task-definition/my-app:1"
LoadBalancerInfo: ContainerName: "web"
ContainerPort: 80
Hooks:
- AfterInstall:
- location: "scripts/migrate.sh"
timeout: 600

Which set of actions must the developer perform to ensure the database migration runs successfully and complies with the rotation requirement?

Show answer & explanation

Answer: Package the database migration script into an AWS Lambda function and update the `AfterInstall` hook in the `appspec.yaml` to reference the Lambda function's ARN. Store the database password in AWS Secrets Manager with automatic rotation enabled, and grant the Lambda function's execution role permissions to retrieve the secret.

Answer

Package the database migration script into an AWS Lambda function, update the `AfterInstall` hook to reference its ARN, store the password in AWS Secrets Manager with automatic rotation, and allow the Lambda execution role to retrieve the secret.
The correct answer correctly identifies that Amazon ECS AppSpec files require lifecycle hooks to point to AWS Lambda functions rather than local shell scripts. It also correctly chooses AWS Secrets Manager over Systems Manager Parameter Store because Secrets Manager features native, built-in support for rotating credentials automatically.

Step-by-Step Solution

1
Analyze the AppSpec file hooks syntax for Amazon ECS.
Identify that the `location` parameter and shell script execution are only supported for EC2/On-Premises deployments. ECS deployments require hooks to point directly to AWS Lambda functions.
To ensure CodeDeploy can execute the database migration hook on the ECS compute platform.
2
Evaluate the database password rotation requirement.
Determine that AWS Secrets Manager provides built-in, out-of-the-box automatic rotation for database secrets, whereas AWS Systems Manager Parameter Store does not support native rotation.
To meet the compliance requirement of rotating the database password every 30 days with minimal administrative overhead.
3
Configure the Lambda function's IAM permissions.
Create an IAM execution role for the Lambda function and attach a policy allowing the `secretsmanager:GetSecretValue` action.
To allow the migration Lambda function to securely retrieve the database credentials during execution.

Key Concept

AWS CodeDeploy AppSpec configuration for Amazon ECS and Secrets Management integration
Estimated Time:3m 0s
Question 13Question →

A company is deploying a containerized microservice to Amazon ECS on AWS Fargate using a blue/green deployment managed by AWS CodeDeploy. The deployment must run a database schema migration script before production traffic is routed to the new task set, and it must execute post-deployment integration tests once the traffic routing is complete. Additionally, the deployment process must have the necessary permissions to interact with ECS and Lambda. Which TWO options represent the correct configuration steps required for this deployment?

Select all that apply

Show answer & explanation

Answer: Configure the AppSpec file with a BeforeAllowTraffic lifecycle hook pointing to a Lambda function that runs the database migration, and an AfterAllowTraffic hook pointing to a Lambda function that executes the post-deployment tests.; Configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

Configure the AppSpec file with a BeforeAllowTraffic hook pointing to a Lambda function to run the database migration and an AfterAllowTraffic hook pointing to a Lambda function for post-deployment tests, and configure the IAM service role used by AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The correct configurations involve using ECS-compatible AppSpec hooks (BeforeAllowTraffic and AfterAllowTraffic invoking Lambda functions) and establishing the correct trust relationship on the CodeDeploy service role (trusting codedeploy.amazonaws.com to perform sts:AssumeRole).

Step-by-Step Solution

1
Analyze the target compute platform and the required hooks.
Since the target platform is Amazon ECS, CodeDeploy lifecycle hooks must invoke AWS Lambda functions rather than executing local shell scripts.
ECS AppSpec syntax specifies Lambda functions for hooks, whereas EC2 AppSpec supports shell script execution.
2
Determine the correct sequencing for database migrations and post-deployment validation.
Migrations must happen before production traffic shifts (BeforeAllowTraffic), and integration tests must run after traffic shifts completely (AfterAllowTraffic).
Running migrations after traffic shifts would cause errors on the new task set, and tests must validate the live production traffic state.
3
Establish the necessary IAM authorization for CodeDeploy.
Configure a trust policy (trust relationship) on the CodeDeploy service role to allow the service principal codedeploy.amazonaws.com to assume it.
A trust policy is required for AWS services to assume a role and perform actions on resources in your account.

Key Concept

AWS CodeDeploy ECS Deployment Lifecycle Hooks and IAM Service Role Configuration
Question 14Question →

A developer is deploying a web application to Amazon EC2 instances using AWS CodeDeploy. The developer needs to execute a script named initialize.sh immediately after the application files are copied to the target instances, but before the application service starts. Which configuration action should the developer take to accomplish this?

Show answer & explanation

Answer: Define the script path under the AfterInstall event in the hooks section of the appspec.yml file.

Answer

Define the script path under the AfterInstall event in the hooks section of the appspec.yml file.
Defining the script path under the AfterInstall event in the hooks section of the appspec.yml file is the correct way to execute scripts on Amazon EC2 instances immediately after files are copied, but before the application starts.

Step-by-Step Solution

1
Identify the target compute platform for the CodeDeploy deployment.
The target compute platform is Amazon EC2.
Different compute platforms (EC2 vs ECS/Lambda) have different AppSpec file structures and lifecycle hooks.
2
Select the correct section in the AppSpec file for Amazon EC2 deployments.
The 'hooks' section is used for EC2 deployments, whereas the 'resources' section is used for ECS/Lambda.
EC2 deployments use the 'hooks' section to execute scripts during deployment lifecycle events.
3
Choose the appropriate lifecycle hook that executes after file copying but before application startup.
The 'AfterInstall' hook runs right after the files are copied, which is before the application service starts.
This meets the requirement of running the initialization script immediately after file copy and before startup.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for EC2 deployments require using the 'hooks' section and the 'AfterInstall' event to run scripts after files are copied.
Question 15Question →

A developer is setting up AWS CodeDeploy to deploy an application to Amazon EC2 instances. The deployment fails because CodeDeploy lacks the necessary permissions to interact with AWS services on behalf of the developer.

Which configuration must the developer implement to resolve this permission issue?

Show answer & explanation

Answer: Create an IAM service role for CodeDeploy and configure its trust policy to allow the codedeploy.amazonaws.com service to assume the role.

Answer

Create an IAM service role for CodeDeploy and configure its trust policy to allow the codedeploy.amazonaws.com service to assume the role.
The correct answer is to create an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role. This permits CodeDeploy to perform necessary operations, such as interacting with EC2 instances, on the developer's behalf.

Step-by-Step Solution

1
Identify the service that requires permissions.
AWS CodeDeploy needs permissions to interact with EC2 instances and other AWS services.
CodeDeploy acts as a service principal and must be authorized to perform actions on your behalf.
2
Create an IAM service role with the correct trust relationship.
A service role is created where the trust policy allows the service principal codedeploy.amazonaws.com to perform the sts:AssumeRole action.
This trust relationship enables the CodeDeploy service to assume the permissions defined in the role.
3
Attach the AWSManagedPolicy for CodeDeploy to the role.
The AWSCodeDeployRole policy is attached to the created IAM role.
This policy contains the permissions CodeDeploy needs to manage deployments.

Key Concept

AWS CodeDeploy Service Role configuration and trust policy requirements
Question 16Question →

A developer is configuring a blue/green deployment for a containerized microservice running on Amazon ECS using AWS CodeDeploy. The deployment must execute a database schema migration before the replacement task set is created. Additionally, after the replacement task set is provisioned and test traffic is routed to it via a test listener, the developer must run integration tests against the test port to validate the deployment before shifting production traffic.

Which of the following configurations should the developer implement in the AppSpec file to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Specify a BeforeInstall hook in the hooks section that references the Amazon Resource Name (ARN) of an AWS Lambda function designed to run the database migrations.; Specify an AfterAllowTestTraffic hook in the hooks section that references the Amazon Resource Name (ARN) of an AWS Lambda function designed to run the integration tests against the test port.

Answer

Specify a BeforeInstall hook in the hooks section referencing the ARN of a Lambda function to run the database migrations, and specify an AfterAllowTestTraffic hook referencing the ARN of a Lambda function to run the integration tests against the test port.
For an Amazon ECS deployment, CodeDeploy lifecycle hooks must reference AWS Lambda functions. The BeforeInstall hook runs before the replacement task set is created, which is the correct time to run database schema migrations. The AfterAllowTestTraffic hook runs after test traffic is routed to the new task set, which is the correct phase to validate the application via the test port before production traffic is shifted.

Step-by-Step Solution

1
Analyze the compute platform and deployment type for the CodeDeploy configuration.
The target compute platform is Amazon ECS, and the deployment type is blue/green.
ECS deployments have a different set of lifecycle hooks compared to EC2/On-Premises, and hooks must target AWS Lambda functions rather than local scripts.
2
Determine the correct hook for running database migrations before task set creation.
The BeforeInstall hook is selected.
BeforeInstall runs before CodeDeploy creates the replacement task set, which is the correct time to run database schema migrations.
3
Determine the correct hook for running integration tests via the test port after test traffic routing.
The AfterAllowTestTraffic hook is selected.
AfterAllowTestTraffic runs after test traffic is shifted to the replacement task set, allowing validation of the application before production traffic is routed.

Key Concept

AWS CodeDeploy ECS Lifecycle Hooks
Question 17Question →

A developer is writing an appspec.yaml file to deploy updates to an AWS Lambda function using AWS CodeDeploy. Which of the following sections or hooks are valid for an AWS Lambda deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: The resources section, which specifies the Lambda function name, alias, current version, and target version.; The AfterAllowTraffic hook, which is used to run validation tasks after traffic has shifted to the new version.

Answer

The valid sections or hooks for an AWS Lambda CodeDeploy deployment are the resources section and the AfterAllowTraffic hook.
In AWS CodeDeploy, the AppSpec file structure depends on the compute platform. For an AWS Lambda deployment, the resources section must be defined to specify the Lambda function name, alias, and versions. Additionally, only two lifecycle hooks are supported: BeforeAllowTraffic and AfterAllowTraffic. The correct choices represent these valid components.

Step-by-Step Solution

1
Identify the target compute platform for the CodeDeploy deployment.
The target compute platform is AWS Lambda.
AppSpec file schemas and valid hooks differ significantly between AWS Lambda, Amazon ECS, and EC2/On-Premises.
2
Filter out sections and hooks that are specific to EC2/On-Premises deployments.
The files section, BeforeInstall hook, and ApplicationStart hook are identified as EC2/On-Premises specific.
EC2 deployments copy files to instances and manage local service lifecycles, which does not apply to serverless Lambda functions.
3
Select the valid Lambda-specific configuration elements from the remaining options.
The resources section (used to define the function metadata) and the AfterAllowTraffic hook (used to run post-deployment validation Lambda functions) are chosen.
AWS Lambda AppSpec files strictly require the resources section and only support BeforeAllowTraffic and AfterAllowTraffic lifecycle hooks.

Key Concept

AWS CodeDeploy AppSpec file structure for AWS Lambda compute platform
Estimated Time:1m 0s
Question 18Question →

A developer is configuring the AppSpec file for an AWS CodeDeploy deployment to Amazon ECS. The developer wants to run a validation test before production traffic is routed to the newly deployed task set. Which lifecycle hook should the developer use in the AppSpec file?

Show answer & explanation

Answer: BeforeAllowTraffic

Answer

BeforeAllowTraffic
The lifecycle hook designed for Amazon ECS deployments to run tasks before traffic shifts to the new task set is BeforeAllowTraffic. This hook allows developers to invoke a Lambda function to validate the new task set prior to routing live traffic.

Step-by-Step Solution

1
Identify the target compute platform for the CodeDeploy deployment.
The target platform is Amazon ECS.
ECS deployments use a specific, limited set of lifecycle hooks compared to EC2/On-premises deployments.
2
Determine the timing requirement for running the validation test.
The test must run after containers are deployed but before production traffic is shifted.
This corresponds to the phase before allowing traffic to the replacement task set.
3
Select the correct Amazon ECS lifecycle hook that executes before traffic shifting.
BeforeAllowTraffic is the correct hook.
This allows running Lambda functions to validate the deployment before any users access it.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks vary by compute platform. Amazon ECS deployments support BeforeAllowTraffic and AfterAllowTraffic to validate deployments before and after traffic shifting, while EC2 deployments support hooks like ApplicationStart and ValidateService.
Question 19Question →

A developer is configuring an AWS CodeDeploy deployment for an AWS Lambda function. The developer needs to define the target Lambda function to deploy and run a validation test before any production traffic shifts to the new version. Which two configurations must the developer include in the AppSpec file to accomplish this? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: A resources section that specifies the Lambda function name, alias, current version, and target version; A BeforeAllowTraffic hook under the hooks section that references a validation Lambda function

Answer

The developer must include a resources section with the Lambda function details (name, alias, current version, and target version) and define a BeforeAllowTraffic lifecycle hook under the hooks section pointing to a validation Lambda function.
To deploy a Lambda function using AWS CodeDeploy, the AppSpec file must define the target function details under the resources section. To run validation tests before shifting traffic, the developer must use the BeforeAllowTraffic lifecycle hook, which runs a separate validation Lambda function before any production traffic begins routing to the new version.

Step-by-Step Solution

1
Identify the compute platform for the CodeDeploy deployment.
The compute platform is AWS Lambda.
Different compute platforms (EC2, ECS, Lambda) have distinct AppSpec schema requirements.
2
Determine how to define the deployment target for AWS Lambda.
Define the function name, alias, current version, and target version in the resources section.
This tells CodeDeploy which function and versions are involved in the deployment.
3
Determine how to run a validation test before traffic shifting.
Add a BeforeAllowTraffic hook in the hooks section pointing to a validation Lambda function.
This hook executes before traffic shifting begins, allowing tests to run and potentially roll back the deployment if they fail.

Key Concept

AWS CodeDeploy AppSpec file structure and lifecycle hooks for AWS Lambda deployments.
Estimated Time:1m 0s
Question 20Question →

A developer is preparing an AppSpec file for an Amazon ECS deployment using AWS CodeDeploy. The developer needs to define lifecycle hooks to validate the deployment before routing production traffic to the new task set. What target type must the developer specify in the AppSpec file to execute the validation tests?

Show answer & explanation

Answer: An AWS Lambda function

Answer

An AWS Lambda function
For Amazon ECS deployments, CodeDeploy lifecycle hooks (such as BeforeAllowTraffic and AfterAllowTraffic) must target an AWS Lambda function. The Lambda function runs the validation code and calls the CodeDeploy API to report success or failure.

Step-by-Step Solution

1
Identify the target compute platform for the CodeDeploy deployment.
The target platform is Amazon ECS.
CodeDeploy handles lifecycle hooks differently depending on whether the target platform is EC2/on-premises versus ECS/Lambda.
2
Determine how validation tests are executed on the Amazon ECS platform.
ECS deployments use AWS Lambda functions to execute validation code for lifecycle hooks.
Because containers in ECS tasks cannot run arbitrary local host scripts during CodeDeploy lifecycle transitions, a Lambda function must be used to perform checks like BeforeAllowTraffic.

Key Concept

AWS CodeDeploy lifecycle hooks for Amazon ECS require AWS Lambda functions to execute validation tests.
Estimated Time:1m 0s
Page 1 / 3Next