Examkin

AWS CodeDeploy

48 questions

All types48Multiple choice25Multiple select23
Question 21Question →

A developer is configuring a deployment for an AWS Lambda function using AWS CodeDeploy. The developer needs to define the deployment configuration and ensure CodeDeploy has the necessary permissions.

Which TWO of the following configurations or steps are required to successfully set up this deployment?

Select all that apply

Show answer & explanation

Answer: Define the Resources section in the AppSpec file specifying the Lambda function name, alias, current version, and target version.; Create an IAM service role for CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service to assume the role.

Answer

To successfully deploy a Lambda function using CodeDeploy, the developer must define the Resources section in the AppSpec file to specify function details, and create an IAM service role for CodeDeploy with a trust policy that permits the codedeploy.amazonaws.com service to assume it.
Defining the Resources section in the AppSpec file is required for Lambda deployments to specify the target function name, alias, and versions. Additionally, CodeDeploy requires an IAM service role with a trust policy allowing the codedeploy.amazonaws.com service to assume it to perform actions on the developer's behalf.

Step-by-Step Solution

1
Identify the target compute platform and the required AppSpec structure.
Since the target platform is AWS Lambda, the AppSpec file must use the Resources section to specify the function name, alias, current version, and target version.
This tells CodeDeploy which function and versions are involved in the deployment.
2
Determine the required IAM configuration for the deployment service.
Create an IAM service role that grants CodeDeploy permissions to interact with AWS Lambda, and ensure the trust policy allows codedeploy.amazonaws.com to assume this role.
CodeDeploy requires permission to perform traffic shifting on the Lambda function.

Key Concept

AWS CodeDeploy Lambda deployment configuration requires specifying function resources in the AppSpec file and establishing an IAM service role that trusts the CodeDeploy service.
Question 22Question →

A developer needs to run a database migration script on Amazon EC2 instances before the new application files are copied during an AWS CodeDeploy deployment. Which configuration file and lifecycle hook should the developer use to execute this script?

Show answer & explanation

Answer: An appspec.yml file in the root directory, running the script in the BeforeInstall hook

Answer

An appspec.yml file in the root directory, running the script in the BeforeInstall hook
AWS CodeDeploy manages EC2/On-Premises deployments using the appspec.yml file located in the root of the source directory. In this file, the developer can define hooks to run scripts at specific phases. The BeforeInstall hook is the appropriate hook to execute scripts (such as database migrations or clearing temp folders) before the actual application files are copied to the instance during the installation phase.

Step-by-Step Solution

1
Identify the service responsible for orchestrating the deployment to Amazon EC2.
The deployment is orchestrated by AWS CodeDeploy.
AWS CodeDeploy requires a configuration file named appspec.yml at the root of the source bundle to define deployment lifecycle hooks.
2
Determine the correct lifecycle hook for running tasks before files are copied.
The BeforeInstall hook is executed prior to the installation phase where files are copied to the target directory.
For EC2/On-Premises deployments, the AppSpec lifecycle sequence runs ApplicationStop -> BeforeInstall -> Install -> AfterInstall -> ApplicationStart -> ValidateService. Therefore, running a script before files are copied requires using BeforeInstall.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for EC2 deployments
Question 23Question →

An organization is transitioning a containerized API from Amazon EC2 to Amazon ECS and implementing blue/green deployments using AWS CodeDeploy. A developer must configure the deployment to execute an AWS Lambda function named "ValidateDeployment" to run smoke tests on the replacement task set after it is provisioned but before any traffic is routed to it. The validation Lambda function must also retrieve database credentials from AWS Secrets Manager during its run. Which configuration represents the correct setup for the AppSpec file and the required IAM roles to support this deployment?

Show answer & explanation

Answer: Use an AppSpec file with capitalized Resources and Hooks sections, defining the Lambda function ARN under Hooks as `- AfterInstall: "arn:aws:lambda:us-east-1:123456789012:function:ValidateDeployment"`. Configure the AWS CodeDeploy service role with a trust policy that allows codedeploy.amazonaws.com to assume the role. Grant the validation Lambda function's execution role permission to retrieve the database credentials from AWS Secrets Manager.

Answer

The correct configuration is to use capitalized Resources and Hooks sections in the AppSpec file, define the validation Lambda function under the AfterInstall hook, configure the AWS CodeDeploy service role to trust codedeploy.amazonaws.com, and grant the validation Lambda function's IAM execution role permission to retrieve the credentials from AWS Secrets Manager.
The correct option correctly identifies that for ECS deployments, the AppSpec file must contain capitalized Resources and Hooks sections, and the validation hook must be a Lambda function defined under a valid ECS hook like AfterInstall. It also correctly specifies that the CodeDeploy service role trust policy must trust codedeploy.amazonaws.com, and the validation Lambda function's execution role must be granted Secrets Manager permissions to retrieve database credentials.

Step-by-Step Solution

1
Identify the AppSpec syntax requirements for ECS deployments.
The AppSpec file must use capitalized Resources and Hooks keys, and the lifecycle hooks must invoke AWS Lambda functions rather than shell scripts.
ECS and Lambda deployments in CodeDeploy utilize a different schema structure than EC2/On-Premises deployments, requiring capitalized keys and Lambda function targets.
2
Determine the correct CodeDeploy lifecycle hook for validation before traffic routing.
AfterInstall runs after the replacement task set is created but before traffic routing starts.
This ensures validation is completed before the production listener shifts traffic to the new task set.
3
Identify the required IAM configurations for CodeDeploy and the validation hook.
The CodeDeploy service role must trust codedeploy.amazonaws.com. The validation Lambda function's IAM execution role must have permissions to assume lambda.amazonaws.com and must be granted secretsmanager:GetSecretValue permissions.
CodeDeploy needs to assume its own service role to execute the deployment, and the Lambda function executes under its own role to retrieve the secrets directly.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks and IAM configuration requirements for Amazon ECS blue/green deployments.
Estimated Time:2m 30s
Question 24Question →

A developer is configuring a deployment for a containerized application to Amazon ECS using AWS CodeDeploy. The developer is writing the AppSpec file in YAML format to manage the lifecycle of the deployment. Which two of the following configurations are valid and supported in the AppSpec file for this Amazon ECS deployment?

Select all that apply

Show answer & explanation

Answer: The resources section specifying the target ECS service name, task definition, container name, and container port.; The hooks section executing AWS Lambda validation functions during events like BeforeAllowTraffic or AfterAllowTraffic.

Answer

The correct configurations are the resources section specifying target service and task definition details, and the hooks section executing AWS Lambda functions during ECS lifecycle events.
For an Amazon ECS deployment, AWS CodeDeploy uses the AppSpec file to determine which ECS task definition to deploy and how to validate traffic routing. The resources section is required to specify details such as the target service, task definition, container name, and container port. The hooks section allows developers to trigger validation Lambda functions at specific points in the blue/green deployment workflow (like BeforeAllowTraffic and AfterAllowTraffic) to ensure the new version is healthy before complete traffic cutover.

Step-by-Step Solution

1
Analyze the target compute platform for the CodeDeploy deployment.
The target platform is Amazon ECS.
The structure and valid parameters of the AppSpec file vary depending on whether the deployment is for EC2/on-premises, AWS Lambda, or Amazon ECS.
2
Determine valid top-level sections for an ECS AppSpec file.
An ECS AppSpec file supports 'version', 'resources', and 'hooks'. It does not support 'files' or 'permissions'.
The resources section defines the ECS task definition and service, while hooks are used to coordinate the blue/green deployment traffic routing.
3
Identify valid lifecycle hooks and execution targets for ECS deployments.
ECS hooks only support AWS Lambda functions as targets. Valid hooks include BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic.
EC2-specific hooks (like ApplicationStart and ApplicationStop) and script execution are unsupported in ECS deployments.

Key Concept

AWS CodeDeploy AppSpec structure for Amazon ECS compute platform
Estimated Time:1m 0s
Question 25Question →

An engineering team is implementing canary deployments for an AWS Lambda function using AWS CodeDeploy. They define the following `appspec.yaml` file to run validation tests on the new function version before traffic is shifted:

yaml
version: 0.0
Resources:
- myLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "myLambdaFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"
Hooks:
- BeforeAllowTraffic: "RunSanityCheck"

The CodeDeploy service role has the AWS-managed policy `AWSCodeDeployRoleForLambda` attached. During execution, the deployment immediately fails at the `BeforeAllowTraffic` lifecycle hook event.

Which of the following is the correct explanation for this deployment failure?

Show answer & explanation

Answer: The CodeDeploy service role lacks permissions to invoke the validation function because the AWS-managed policy restricts `lambda:InvokeFunction` to functions prefixed with `CodeDeployHook_`.

Answer

The CodeDeploy service role lacks permissions to invoke the validation function because the AWS-managed policy restricts `lambda:InvokeFunction` to functions prefixed with `CodeDeployHook_`.
The standard AWS-managed policy `AWSCodeDeployRoleForLambda` restricts the `lambda:InvokeFunction` permission to functions whose names start with the prefix `CodeDeployHook_`. Because the validation function is named `RunSanityCheck`, the CodeDeploy service role is not authorized to invoke it, leading to a failure during the `BeforeAllowTraffic` hook execution and triggering an automatic rollback.

Step-by-Step Solution

1
Analyze the AppSpec file for the compute platform target and hooks.
The target is AWS Lambda, and the validation hook `RunSanityCheck` is registered under `BeforeAllowTraffic`.
This confirms the hook placement and names conform to the AWS Lambda AppSpec specification.
2
Examine the IAM permissions of the CodeDeploy service role with `AWSCodeDeployRoleForLambda` attached.
The policy permits `lambda:InvokeFunction` but restricts the resource ARN to `arn:aws:lambda:*:*:function:CodeDeployHook_*`.
This is a security best practice built into the AWS-managed policy to prevent CodeDeploy from executing arbitrary Lambda functions.
3
Compare the validation function name with the policy constraint.
The function name `RunSanityCheck` does not start with `CodeDeployHook_`, triggering an AccessDenied exception during invocation.
Identifying the naming mismatch resolves why the deployment fails at the lifecycle hook execution step.

Key Concept

AWS CodeDeploy Lambda Hook Validation Permissions
Estimated Time:2m 0s
Question 26Question →

A developer is using AWS CodeDeploy to deploy a Node.js web application to a fleet of Amazon EC2 instances. During the initial deployment run, the deployment fails.

The developer inspects the deployment console and identifies two root causes:
1. The CodeDeploy service is unable to interact with the EC2 instances to initiate the deployment.
2. A bash script specified in the `appspec.yml` file fails with an access denied error when attempting to retrieve database credentials from AWS Systems Manager Parameter Store.

The application's `appspec.yml` file is configured as follows:

yaml
version: 0.0
os: linux
files:
- source: /index.js
destination: /var/www/html/
hooks:
BeforeInstall:
- location: scripts/decrypt_creds.sh
timeout: 300
runas: dbadmin

Which two configurations must the developer implement to resolve these issues? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.; Attach an IAM policy that grants ssm:GetParameters and ssm:GetParameter permissions to the IAM role associated with the EC2 instance profile.

Answer

Configure the trust policy of the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action, and attach an IAM policy that grants ssm:GetParameters and ssm:GetParameter permissions to the IAM role associated with the EC2 instance profile.
The CodeDeploy service role requires a trust policy allowing the codedeploy.amazonaws.com service principal to assume the role. This permits the service to perform deployment orchestration. When the CodeDeploy agent runs scripts defined under the hooks section on the EC2 instance, the script processes assume the identity of the EC2 instance profile. Therefore, to fetch parameters from the Systems Manager Parameter Store, the instance profile's associated role must have the ssm:GetParameters and ssm:GetParameter permission policies attached.

Step-by-Step Solution

1
Analyze CodeDeploy service permissions.
The CodeDeploy service itself requires an IAM service role to communicate with EC2 instances. The trust relationship for this service role must explicitly permit the codedeploy.amazonaws.com service principal to execute the sts:AssumeRole action.
This establishes trust between CodeDeploy and the IAM role, allowing the service to orchestrate deployments.
2
Determine the execution environment of AppSpec script hooks.
Scripts defined in the AppSpec hooks section run locally on target EC2 instances, executed by the CodeDeploy agent daemon.
This helps locate which IAM role requires permissions to query external AWS APIs during script runs.
3
Assign Parameter Store permissions to the correct entity.
Assign ssm:GetParameter and ssm:GetParameters to the EC2 instance profile role rather than the CodeDeploy service role.
Because the agent running on the EC2 instance executes the decrypt_creds.sh script locally, it uses the credentials supplied by the EC2 instance profile.

Key Concept

AWS CodeDeploy Service Role vs. EC2 Instance Profile Permissions
Question 27Question →

A developer is configuring a deployment to shift traffic to a new version of an AWS Lambda function using AWS CodeDeploy. The deployment group is configured with an IAM service role. When the deployment is initiated, the developer encounters an error during the initial validation of the AppSpec file, and the deployment is aborted. The AppSpec file is configured as follows:

yaml
version: 0.0
Resources:
- MyLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "MyServiceFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"
Hooks:
- BeforeInstall: "ValidationFunction"

What is the reason for this deployment failure?

Show answer & explanation

Answer: The AppSpec file specifies 'BeforeInstall' under the 'Hooks' section, which is a lifecycle hook reserved for EC2/on-premises and ECS deployments and is invalid for AWS Lambda deployments.

Answer

The AppSpec file specifies 'BeforeInstall' under the 'Hooks' section, which is a lifecycle hook reserved for EC2/on-premises and ECS deployments and is invalid for AWS Lambda deployments.
The correct option is correct because AWS CodeDeploy deployments for the Lambda compute platform only support the 'BeforeAllowTraffic' and 'AfterAllowTraffic' lifecycle hooks. Hook names such as 'BeforeInstall', 'AfterInstall', and 'AfterAllowTestTraffic' are invalid for Lambda deployments (though they are valid for ECS or EC2/on-premises deployments). Specifying an invalid hook causes the AppSpec validation to fail before the deployment can proceed.

Step-by-Step Solution

1
Inspect the resources and hooks sections of the AppSpec file.
Identify that the resource type is 'AWS::Lambda::Function' and the hook is 'BeforeInstall'.
AWS CodeDeploy supports different hooks depending on the target compute platform.
2
Recall the valid lifecycle hooks for AWS Lambda deployments in AWS CodeDeploy.
Lambda deployments only support 'BeforeAllowTraffic' and 'AfterAllowTraffic'.
Other hooks like 'BeforeInstall' are only applicable to EC2/on-premises or ECS platforms.
3
Identify why the validation failed based on the hook mismatch.
The presence of 'BeforeInstall' causes the AppSpec validation to fail immediately.
CodeDeploy rejects AppSpec files containing invalid hooks for the specified resource type.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for AWS Lambda deployments
Question 28Question →

A developer is configuring a blue/green deployment for a containerized microservice on Amazon ECS using AWS CodeDeploy. The deployment must execute an AWS Lambda function to perform database migrations before the load balancer begins routing production traffic to the new task set. The database password must be rotated automatically every week. During the configuration phase, the deployment fails because of lifecycle and permission errors. Which of the following configurations will successfully execute the database migration during the deployment?

Show answer & explanation

Answer: Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.

Answer

Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.
The configuration using the BeforeAllowTraffic lifecycle hook, AWS Secrets Manager, and proper IAM permission policies is correct because it correctly aligns with ECS-specific deployment hooks, meets the automated rotation requirements, and correctly permissions CodeDeploy to execute the validation Lambda function.

Step-by-Step Solution

1
Identify the correct CodeDeploy lifecycle hook for ECS deployments.
BeforeAllowTraffic is identified as the valid hook because ECS deployments do not support EC2-specific lifecycle hooks like BeforeInstall.
Choosing the correct hook prevents deployment validation errors in the AppSpec file.
2
Determine the correct service for storing database credentials requiring rotation.
AWS Secrets Manager is chosen because it supports automatic rotation natively, unlike Systems Manager Parameter Store.
Meeting the requirement for weekly automatic rotation of credentials.
3
Configure the necessary IAM permissions for CodeDeploy to invoke the migration Lambda function.
Attach an identity-based policy granting lambda:InvokeFunction to the CodeDeploy service role.
Ensuring CodeDeploy has the operational permission to trigger the validation Lambda hook during deployment.

Key Concept

AWS CodeDeploy ECS lifecycle hooks, secrets management, and IAM permission vs trust policies.
Question 29Question →

An engineering team is setting up a CI/CD pipeline using AWS CodeDeploy to deploy a Node.js web application to a fleet of Amazon EC2 instances. The deployment configuration must ensure that the application is fully running and able to handle traffic before the deployment is marked as successful. Additionally, CodeDeploy requires authorization to interact with EC2 auto-scaling groups and load balancers during the deployment process.

Which of the following configurations must be implemented to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure an IAM service role for AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.; Use the ValidateService lifecycle hook in the appspec.yml file to execute a script that checks the application's local health endpoint.

Answer

Configure an IAM service role for AWS CodeDeploy with a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role, and use the ValidateService lifecycle hook in the appspec.yml file to execute a script that checks the application's local health endpoint.
To allow AWS CodeDeploy to perform deployments on EC2/On-Premises instances, it needs a service role that trusts the 'codedeploy.amazonaws.com' service principal. This role grants the service permission to interact with other AWS services like EC2, Auto Scaling, and Elastic Load Balancing. To verify the service health post-deployment, the 'ValidateService' lifecycle hook in the EC2 AppSpec file must be used to run validation scripts before CodeDeploy marks the deployment as successful.

Step-by-Step Solution

1
Determine the necessary IAM configuration for AWS CodeDeploy authorization.
Identify that AWS CodeDeploy must be configured with an IAM service role (not an EC2 instance profile) whose trust policy explicitly lists the 'codedeploy.amazonaws.com' service principal. This allows CodeDeploy to interact with EC2, Auto Scaling, and Elastic Load Balancing APIs.
Without this service role, CodeDeploy lacks the permissions to execute deployments across the target instances and infrastructure.
2
Map the correct AppSpec lifecycle hook for post-deployment verification on Amazon EC2.
Select the 'ValidateService' lifecycle hook inside the EC2 'appspec.yml' file to execute local verification scripts.
In EC2/On-Premises deployment groups, ValidateService is the proper hook for service validation, whereas hooks like BeforeAllowTraffic are restricted to ECS and Lambda deployment types.
3
Rule out incorrect trust policies and mismatched API permissions.
Discard modifications to the EC2 instance profile's trust policy (which must trust EC2, not CodeDeploy) and correct Systems Manager Parameter Store permissions (which require SSM API permissions rather than Secrets Manager permissions).
This isolates the correct configurations for service trust boundaries and parameter store access.

Key Concept

Configuring AWS CodeDeploy service roles and understanding EC2-specific AppSpec lifecycle hooks.
Estimated Time:2m 0s
Question 30Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The developer wants to run a validation script to perform smoke tests before production traffic is routed to the new task set. The developer creates the following `appspec.yaml` file:

yaml
version: 0.0
Resources:
- TargetService:
Type: AWS::ECS::Service
Properties:
TaskDefinition: "arn:aws:ecs:us-east-1:123456789012:task-definition/my-app:1"
LoadBalancerInfo:
ContainerName: "my-app-container"
ContainerPort: 8080
Hooks:
- BeforeAllowTraffic:
- location: scripts/run-smoke-tests.sh
timeout: 300

During deployment, the CodeDeploy agent fails to parse the AppSpec file. How should the developer modify the AppSpec file to resolve this issue?

Show answer & explanation

Answer: Replace the BeforeAllowTraffic script block with the Amazon Resource Name (ARN) of an AWS Lambda function that executes the validation logic.

Answer

Replace the BeforeAllowTraffic script block with the Amazon Resource Name (ARN) of an AWS Lambda function that executes the validation logic.
For Amazon ECS deployments, CodeDeploy AppSpec files require the hooks to reference the Amazon Resource Name (ARN) of an AWS Lambda function rather than a local file path. The script execution structure (location, timeout, runas) is only supported for Amazon EC2 and on-premises deployments. Replacing the script block with the Lambda ARN enables CodeDeploy to trigger the validation function properly.

Step-by-Step Solution

1
Analyze the target deployment platform and AppSpec configuration.
The target platform is Amazon ECS, and the AppSpec file defines Resources and Hooks sections.
Different compute platforms (EC2 vs ECS/Lambda) have different AppSpec validation schemas and lifecycle hook requirements.
2
Evaluate the syntax used under the BeforeAllowTraffic hook in the AppSpec file.
The developer specified a local script path ('location: scripts/run-smoke-tests.sh'), which is EC2-specific syntax.
For ECS deployments, CodeDeploy lifecycle hooks must map to an AWS Lambda function ARN rather than a local file path.
3
Select the correction that provides a valid AWS Lambda function ARN for the ECS hook.
Replacing the script block with a Lambda function ARN resolves the parser error.
This complies with the ECS AppSpec specification for Hook definitions.

Key Concept

For Amazon ECS and AWS Lambda deployments in CodeDeploy, AppSpec lifecycle hooks can only execute validation tests via AWS Lambda functions specified by their ARNs, not through local shell scripts.
Question 31Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute a validation AWS Lambda function to verify the health of the new task set before shifting production traffic. The validation function requires access to a database password that must be automatically rotated every 30 days. Additionally, the CodeDeploy service itself requires permissions to manage the ECS deployment. Which combination of configurations should the developer use to meet these requirements?

Show answer & explanation

Answer: Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Answer

Configure the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function; store the database password in AWS Secrets Manager and enable automatic rotation; assign CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.
The correct configuration uses the BeforeAllowTraffic hook in the appspec.yaml file to invoke the validation Lambda function, stores the database password in AWS Secrets Manager to support automatic rotation, and assigns CodeDeploy a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role.

Step-by-Step Solution

1
Determine the correct CodeDeploy lifecycle hook in the appspec.yaml file for invoking validation tests on Amazon ECS.
The BeforeAllowTraffic hook is identified as the valid lifecycle hook for ECS deployments.
ECS deployments only support BeforeAllowTraffic and AfterAllowTraffic hooks for running validation Lambda functions, whereas BeforeInstall is an EC2 hook.
2
Select the AWS service to store the database password with automatic 30-day rotation support.
AWS Secrets Manager is selected.
AWS Secrets Manager natively supports automatic rotation of database credentials, whereas Systems Manager Parameter Store does not provide built-in automatic rotation.
3
Verify the trust policy configuration for the IAM role assumed by AWS CodeDeploy.
The trust policy must allow the codedeploy.amazonaws.com service principal to assume the role.
AWS CodeDeploy needs permission to interact with ECS on the developer's behalf. The trust relationship must be with codedeploy.amazonaws.com, not ecs-tasks.amazonaws.com.

Key Concept

AWS CodeDeploy deployment configuration for ECS including AppSpec lifecycle hooks, Secrets Manager integration, and IAM trust policies.
Estimated Time:1m 30s
Question 32Question →

A developer is setting up an automated canary deployment for an AWS Lambda function using AWS CodeDeploy. The deployment is defined by the following `appspec.yml` template fragment:

yaml
version: 0.0
Resources:
- MyLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "MyLambdaFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"

The developer needs to modify this configuration to execute a validation Lambda function before traffic shifting begins, and must configure the CodeDeploy service role with the correct trust relationship and permissions.

Which two actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the AppSpec file, add a Hooks section under the root level and configure the BeforeAllowTraffic lifecycle event to point to the validation Lambda function.; Configure the IAM service role used by AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role, and attach the AWSCodeDeployRoleForLambda managed policy.

Answer

Add a Hooks section with BeforeAllowTraffic pointing to the validation Lambda function, and configure the IAM service role for AWS CodeDeploy with a trust policy that permits codedeploy.amazonaws.com to assume the role.
For AWS Lambda deployments, the AppSpec file uses the 'Hooks' section to trigger Lambda functions during lifecycle events. The 'BeforeAllowTraffic' event runs validation functions before the traffic shifting begins. Additionally, AWS CodeDeploy requires an IAM service role with a trust policy that allows the 'codedeploy.amazonaws.com' service to assume the role via 'sts:AssumeRole' so it can execute deployments on your behalf.

Step-by-Step Solution

1
Identify the correct AppSpec schema and lifecycle hooks for AWS Lambda deployments.
Confirm that the 'Hooks' section is used at the root level and 'BeforeAllowTraffic' is the valid event to run validation tests before shifting traffic.
Ensure validation logic is executed at the correct lifecycle stage for serverless deployments.
2
Configure the IAM trust policy for the CodeDeploy service role.
Ensure the trust policy allows the 'codedeploy.amazonaws.com' service to assume the role.
Allows AWS CodeDeploy to assume the role and execute the deployment operations.
3
Verify credentials storage and rotation configuration.
Avoid choosing Parameter Store for secrets that require native automatic rotation capabilities.
Avoid common configuration mistakes related to credential security.

Key Concept

AWS CodeDeploy Lambda Deployment Lifecycle Hooks and Service Role configuration
Estimated Time:2m 0s
Question 33Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute an AWS Lambda function to run validation tests on the replacement task set after test traffic is routed, but before production traffic is shifted. The validation tests require a database password that must be rotated automatically every 30 days. Additionally, CodeDeploy requires an IAM service role to perform the deployment. Which configuration should the developer implement?

Show answer & explanation

Answer: Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.

Answer

Configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role, store the password in AWS Secrets Manager, and define the validation Lambda function under the AfterAllowTestTraffic hook in the AppSpec file.
The correct configuration requires the AWS CodeDeploy service role to have a trust policy allowing codedeploy.amazonaws.com to assume it. For storing credentials that need automatic rotation, AWS Secrets Manager is the appropriate service as it has native integration for rotation (unlike Systems Manager Parameter Store). In Amazon ECS deployments, validation tests are run using the AfterAllowTestTraffic lifecycle hook in the AppSpec file, which runs after test traffic is routed but before production traffic is allowed. ValidateService is an EC2-specific lifecycle hook and is not supported in ECS deployments.

Step-by-Step Solution

1
Determine the required IAM trust policy principal for the CodeDeploy service role.
The trust policy must allow the principal codedeploy.amazonaws.com to assume the role.
CodeDeploy requires permission to assume the service role to orchestrate the deployment on behalf of the developer.
2
Identify the proper storage service for a database password requiring automatic rotation.
AWS Secrets Manager must be used instead of Systems Manager Parameter Store.
Secrets Manager natively supports automatic rotation (e.g., every 30 days) via built-in integration, whereas Parameter Store does not support automatic rotation natively.
3
Select the correct lifecycle hook for running validation tests on an ECS blue/green deployment.
The validation Lambda function must be defined under the AfterAllowTestTraffic hook in the AppSpec file.
ECS blue/green deployments support validation tests after test traffic is routed using the AfterAllowTestTraffic hook. ValidateService is an EC2-specific hook and cannot be used in ECS deployments.

Key Concept

AWS CodeDeploy deployment configuration, IAM service roles, secret rotation, and ECS lifecycle hooks.
Estimated Time:2m 0s
Question 34Question →

A development team is deploying an updated AWS Lambda function using AWS CodeDeploy with a linear traffic-shifting configuration. Before any production traffic is routed to the new function version, the deployment process must run a separate validation Lambda function to perform smoke tests.

Which lifecycle hook must be specified in the `Hooks` section of the `appspec.yml` file to execute the validation function?

Show answer & explanation

Answer: BeforeAllowTraffic

Answer

BeforeAllowTraffic
The BeforeAllowTraffic lifecycle hook is one of the two hooks supported for AWS Lambda deployments in AWS CodeDeploy. It executes before traffic routing to the new Lambda version starts, which is the correct phase to run a validation function.

Step-by-Step Solution

1
Identify the target compute platform for the AWS CodeDeploy deployment.
The target compute platform is AWS Lambda.
Deployment lifecycle hooks in AWS CodeDeploy are platform-specific and differ between EC2/on-premises, Amazon ECS, and AWS Lambda.
2
Determine the required phase of the deployment for running the validation test.
The validation test must run before any production traffic is shifted to the new Lambda version.
Running tests early prevents routing production traffic to a broken or misconfigured version.
3
Select the appropriate Lambda-supported lifecycle hook from the available options.
The BeforeAllowTraffic hook is the correct hook that executes before traffic shifting begins.
AWS Lambda deployments in CodeDeploy support only BeforeAllowTraffic and AfterAllowTraffic hooks.

Key Concept

AWS CodeDeploy supports a specific set of deployment lifecycle hooks for AWS Lambda, which are different from those used for Amazon ECS and EC2. Specifically, only BeforeAllowTraffic and AfterAllowTraffic are valid for Lambda deployments.
Estimated Time:1m 0s
Question 35Question →

A developer is configuring AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The deployment must copy application files to the target instances and run a shell script (scripts/initialize.sh) that installs application dependencies. During execution, this script must download a configuration file from a secured Amazon S3 bucket.

Which two options must the developer configure to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define the script path and execution settings under the AfterInstall lifecycle hook in the hooks section of the appspec.yml file.; Attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.

Answer

Define the script path and execution settings under the AfterInstall lifecycle hook in the appspec.yml file, and attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.
The correct options are to define the script execution under the AfterInstall hook in the appspec.yml file and to attach an S3 read permission policy to the EC2 instance profile. The AfterInstall hook is a standard EC2 deployment lifecycle hook suitable for post-installation tasks like installing dependencies. Because the CodeDeploy agent runs directly on the EC2 instances, any commands executed by the agent (such as scripts in the hooks section) run under the security context of the EC2 instance. Therefore, the instance profile attached to the EC2 instances must have permissions to access the S3 bucket.

Step-by-Step Solution

1
Determine the correct lifecycle hook for the EC2 deployment script.
The AfterInstall hook is selected as the appropriate hook to run dependency installation scripts after the application bundle has been copied.
EC2 deployments use specific lifecycle hooks like BeforeInstall, Install, AfterInstall, and ApplicationStart. The script must run after files are copied.
2
Determine the proper IAM credentials configuration for script execution.
The EC2 instance profile must be granted the s3:GetObject permission.
Scripts executed by the CodeDeploy agent run on the EC2 instance itself and use the instance's IAM role (instance profile) to authenticate to S3, not the CodeDeploy service role.

Key Concept

Understanding AWS CodeDeploy EC2 lifecycle hooks and how IAM permissions are resolved for scripts executed by the CodeDeploy agent on EC2 instances.
Question 36Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. The deployment must execute an AWS Lambda function to run validation tests on the replacement task set before production traffic is shifted. The validation tests require retrieving a database password that must be rotated automatically every 30 days. Additionally, the developer must configure the IAM trust policy for the CodeDeploy service role to allow the service to perform the deployment.

Which configuration should the developer implement?

Show answer & explanation

Answer: Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file. Store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.

Answer

Configure the validation Lambda function under the `AfterInstall` lifecycle hook in the `appspec.yaml` file, store the database password in AWS Secrets Manager, and configure the CodeDeploy service role's trust policy to allow `codedeploy.amazonaws.com` to assume the role.
The correct configuration uses the `AfterInstall` lifecycle hook in the `appspec.yaml` file, which is valid for ECS blue/green deployments to run validation tests on the replacement task set before traffic routing. It stores the database password in AWS Secrets Manager because Secrets Manager natively supports automatic rotation of secrets. Lastly, the CodeDeploy service role trust policy must allow `codedeploy.amazonaws.com` to assume the role so CodeDeploy can perform the deployment tasks.

Step-by-Step Solution

1
Determine the appropriate lifecycle hook for running validation tests on Amazon ECS in AWS CodeDeploy.
The `AfterInstall` hook is selected.
In ECS blue/green deployments, CodeDeploy supports specific hooks such as `AfterInstall` and `AfterAllowTestTraffic` to run validation Lambda functions. Hooks like `ValidateService` are EC2-specific and not supported on ECS.
2
Evaluate the requirement for rotating a database password automatically.
AWS Secrets Manager is chosen.
AWS Secrets Manager natively supports automatic rotation of secrets (e.g., every 30 days) using built-in or custom Lambda functions. AWS Systems Manager Parameter Store does not support native automatic rotation.
3
Determine the service principal for the CodeDeploy service role trust policy.
Configure `codedeploy.amazonaws.com` as the trusted entity.
The service performing the deployment (AWS CodeDeploy) needs permission to assume the role. The principal `ecs-tasks.amazonaws.com` is used for ECS tasks to gain permissions to AWS resources, not for the CodeDeploy deployment service itself.

Key Concept

Understanding the differences between Amazon ECS and EC2 CodeDeploy lifecycle hooks, choosing appropriate AWS storage options for rotated secrets, and configuring proper IAM service trust policies.
Question 37Question →

A developer is configuring a blue/green deployment for an Amazon ECS application using AWS CodeDeploy. The deployment must execute validation tests on the green task set after it starts but before production traffic is directed to it. In addition, the developer must ensure that AWS CodeDeploy has the correct permissions to perform the deployment. Which two configurations must the developer implement to satisfy these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: In the AppSpec file, specify an AWS Lambda function under the AfterAllowTestTraffic lifecycle hook to perform validation tests on the green task set.; Configure the AWS IAM service role for CodeDeploy with a trust policy that allows the service principal codedeploy.amazonaws.com to assume the role.

Answer

To configure validation testing and permissions for an ECS blue/green deployment, the developer must specify an AWS Lambda function under the AfterAllowTestTraffic hook in the AppSpec file, and configure the CodeDeploy service role trust policy to allow codedeploy.amazonaws.com to assume the role.
For validation testing on Amazon ECS, the AppSpec file must define an AWS Lambda function under the AfterAllowTestTraffic hook, allowing testing on the green task set before production traffic is routed. Furthermore, CodeDeploy needs a service role with a trust policy that designates the codedeploy.amazonaws.com service principal as an allowed entity to assume the role.

Step-by-Step Solution

1
Determine the correct CodeDeploy AppSpec hook for validation testing before shifting production traffic in ECS.
Identify the AfterAllowTestTraffic lifecycle hook.
This hook executes after traffic is directed to the test port on the green task set, allowing validation tests to run prior to the production traffic shift.
2
Select the correct executor type for ECS AppSpec lifecycle hooks.
Use an AWS Lambda function for the lifecycle hook.
Unlike EC2 deployments, CodeDeploy hook executions for ECS and Lambda deployments only support invoking an AWS Lambda function, not executing custom shell scripts.
3
Configure the IAM trust policy for the CodeDeploy service role.
Add codedeploy.amazonaws.com as the principal in the AssumeRole policy statement.
This allows CodeDeploy to assume the service role and make API calls to update the ECS service and shift traffic on behalf of the developer.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for ECS and the trust policy required for the CodeDeploy service role.
Question 38Question →

A developer is configuring an in-place deployment to a fleet of Amazon EC2 instances registered with an Application Load Balancer using AWS CodeDeploy. The developer needs to run a local shell script named `verify_health.sh` to confirm that the application server is responding successfully on port 8080. This verification must execute after the application has started but before the instances are reregistered with the load balancer to receive production traffic. Which lifecycle hook in the `appspec.yml` file must the developer use to run this script?

Show answer & explanation

Answer: ValidateService

Answer

ValidateService
The ValidateService lifecycle hook is the designated phase in EC2/On-Premises deployments to run verification scripts. It executes after the application has started (ApplicationStart) and before CodeDeploy reregisters the instances with the Application Load Balancer target group. A successful script exit code allows the deployment to proceed, while a non-zero exit code triggers an automatic rollback.

Step-by-Step Solution

1
Identify the compute platform and deployment style.
Compute platform is Amazon EC2, and the deployment is an in-place update with a load balancer.
Different compute platforms (EC2 vs. ECS/Lambda) support different sets of AppSpec lifecycle hooks.
2
Determine which hooks support running user-defined scripts on EC2 instances.
Only specific hooks like BeforeInstall, AfterInstall, ApplicationStart, and ValidateService support script execution on EC2.
Load balancer hooks such as BeforeAllowTraffic are managed by CodeDeploy to update target group registration and cannot run user-defined scripts in the AppSpec file.
3
Order the lifecycle hooks to locate the correct phase after application startup but before traffic registration.
The ApplicationStart hook starts the service, followed by ValidateService to run health checks. Only after ValidateService passes does CodeDeploy proceed to BeforeAllowTraffic/AllowTraffic.
This guarantees that unhealthy instances are caught and the deployment is rolled back before they are exposed to production traffic.

Key Concept

AWS CodeDeploy AppSpec lifecycle hook execution order and capability differences between EC2/On-Premises and ECS/Lambda compute platforms.
Question 39Question →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. During the deployment process, the deployment fails with an access denied error because CodeDeploy is unable to modify the Application Load Balancer listeners and target groups. The developer verifies that the CodeDeploy service role has the AWSCodeDeployRoleForECS managed policy attached. Which configuration must the developer verify or update to resolve this deployment failure?

Show answer & explanation

Answer: The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.

Answer

The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.
The trust policy of an IAM role defines which principal (such as an AWS service or another account) is allowed to assume the role. For AWS CodeDeploy to perform deployment actions on behalf of the developer (such as updating ECS target groups), its service role's trust policy must trust the CodeDeploy service principal (codedeploy.amazonaws.com) and allow the sts:AssumeRole action. If this trust policy is missing or misconfigured, CodeDeploy cannot assume the role, resulting in an access denied error even if the role has the correct permissions attached.

Step-by-Step Solution

1
Analyze the deployment error and identify that CodeDeploy failed to assume the service role despite the correct permissions policy being attached.
Recognize that the failure is related to IAM role delegation/trust rather than the permissions policy contents.
CodeDeploy must be trusted by the service role before it can assume it to perform deployment tasks on ECS resources.
2
Locate the CodeDeploy service role in the IAM console and inspect its trust relationships (trust policy).
Determine that the trust policy must explicitly allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
Without this trust policy, AWS Security Token Service (STS) will deny the assume role request, causing CodeDeploy to fail with an access denied error.

Key Concept

AWS CodeDeploy Service Role Trust Policy
Estimated Time:1m 30s
Question 40Question →

A developer is configuring a canary deployment for an AWS Lambda function using AWS CodeDeploy. The deployment must run a test Lambda function to validate the deployment before shifting traffic, and another test Lambda function to run post-deployment validation checks after all traffic has been shifted to the new version. Which two configuration steps must the developer perform to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file.; Attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions, and ensure its trust policy allows the codedeploy.amazonaws.com service principal.

Answer

Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file, and attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions while ensuring its trust policy allows the codedeploy.amazonaws.com service principal.
The correct options properly configure the deployment lifecycle hooks for AWS Lambda (BeforeAllowTraffic and AfterAllowTraffic) in the AppSpec file and grant the required invoke permissions to the CodeDeploy service role.

Step-by-Step Solution

1
Identify the target compute platform and the required hooks.
The target is AWS Lambda. The appropriate lifecycle hooks for running validation tests before traffic shifting starts and after it completes are BeforeAllowTraffic and AfterAllowTraffic.
Choosing the correct lifecycle hooks ensures CodeDeploy triggers the validation tests at the correct points in the deployment process.
2
Configure the CodeDeploy service role permissions.
Ensure the CodeDeploy service role has a trust relationship with codedeploy.amazonaws.com and contains permissions for lambda:InvokeFunction targeting the test Lambda functions.
CodeDeploy must be authorized to assume its role and invoke the external Lambda functions designated as validation hooks.

Key Concept

AWS CodeDeploy lifecycle hooks for Lambda deployments and their associated IAM permissions.
PreviousPage 2 / 3Next