Examkin

AWS CodeDeploy

48 questions

All types48Multiple choice25Multiple select23
Question 41Question →

A developer is configuring a deployment group in AWS CodeDeploy to deploy an application to a fleet of Amazon EC2 instances. The developer creates a new IAM role to serve as the service role for the deployment group. However, when the deployment is initiated, it fails immediately with a service role authorization error before any lifecycle event scripts in the appspec.yml file are executed. Which configuration issue is the most likely cause of this failure?

Show answer & explanation

Answer: The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.

Answer

The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.
The correct option is correct because AWS CodeDeploy needs to assume the specified service role to perform operations such as registering instances, updating Auto Scaling groups, and interacting with load balancers. This trust is established via the trust policy of the role, which must explicitly allow the 'codedeploy.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. If this trust policy is missing or incorrect, the CodeDeploy service cannot assume the role, and the deployment fails immediately with an authorization error.

Step-by-Step Solution

1
Analyze the timing and nature of the error, noting that the deployment fails immediately with a 'service role authorization error' before CodeDeploy attempts to connect to the target instances or run any lifecycle scripts.
This indicates that the issue lies with the permissions of the CodeDeploy service itself to act on the user's behalf, rather than an agent or configuration file issue on the EC2 instances.
Before any deployment actions can be orchestrated, the AWS CodeDeploy service must successfully assume the service role associated with the deployment group.
2
Examine the role requirements for AWS CodeDeploy to perform deployment actions on AWS resources.
CodeDeploy requires an IAM service role with a trust policy allowing the 'codedeploy.amazonaws.com' service principal to perform 'sts:AssumeRole'.
Without this trust policy, the AWS Security Token Service (STS) will reject CodeDeploy's request to assume the role, preventing the deployment from starting.
3
Differentiate between the CodeDeploy service role and the EC2 instance profile role, and rule out other configuration issues.
The EC2 instance profile role is assumed by the EC2 service to allow the agent to read from S3. The AppSpec file hooks and parameter configurations are parsed much later by the agent, so failures there would not occur immediately at the start of the deployment.
This confirms that the missing trust relationship on the CodeDeploy service role is the root cause of the immediate service role authorization failure.

Key Concept

AWS CodeDeploy IAM service role and trust relationship requirements
Question 42Question →

An organization is transitioning their microservices to Amazon ECS and plans to use AWS CodeDeploy for automated blue/green deployments. To ensure zero downtime, the deployment workflow must execute validation tests against the replacement task set on a secondary port before shifting any production traffic. Furthermore, AWS CodeDeploy must be authorized to interact with the ECS cluster and load balancer during the deployment execution.

Which TWO configuration actions should the developer perform to support this deployment flow?

Select all that apply

Show answer & explanation

Answer: Define the validation test under the AfterAllowTestTraffic lifecycle hook in the AppSpec file to trigger a validation AWS Lambda function.; Configure a trust policy on the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Answer

To support this deployment flow, the developer must configure the validation tests under the AfterAllowTestTraffic lifecycle hook in the AppSpec file to trigger a validation AWS Lambda function, and configure a trust policy on the CodeDeploy service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
To run validation tests on a test listener before production traffic shifts, the AfterAllowTestTraffic hook must be used to trigger a validation Lambda function. Additionally, CodeDeploy requires a service role with a trust policy that allows codedeploy.amazonaws.com to assume the role via sts:AssumeRole so it has the permissions to execute the deployment.

Step-by-Step Solution

1
Determine the deployment platform and validation timing requirement.
The target platform is Amazon ECS, and validation must occur on a test port before production traffic shifts.
This determines which AppSpec hooks and execution environments are valid.
2
Select the correct AppSpec hook and execution format for ECS.
The AfterAllowTestTraffic hook must be configured with a Lambda function reference. Script execution is not supported for ECS.
Only Lambda hooks are supported for ECS, and AfterAllowTestTraffic runs after the test listener routes traffic but before the production listener shifts.
3
Identify the service authorization mechanism.
CodeDeploy itself needs permissions, which requires a CodeDeploy service role with a trust policy for codedeploy.amazonaws.com.
This enables CodeDeploy to call ECS and Elastic Load Balancing APIs to execute the deployment.

Key Concept

AWS CodeDeploy ECS Deployment Validation and IAM Authorization
Question 43Question →

A developer is configuring an AWS CodeDeploy deployment group to perform a blue/green deployment for an Amazon ECS service. The developer wants to run validation tests against the replacement task set using a test listener before routing production traffic. The deployment fails during the validation phase. Upon reviewing the logs, the developer discovers that the AppSpec file specifies an invalid lifecycle hook for the ECS compute platform, and CodeDeploy is unable to invoke the validation Lambda function due to incorrect IAM permissions. Which combination of configurations will correctly resolve these issues?

Show answer & explanation

Answer: Change the AppSpec lifecycle hook to AfterAllowTestTraffic and ensure that the CodeDeploy service role is granted lambda:InvokeFunction permissions.

Answer

Change the AppSpec lifecycle hook to AfterAllowTestTraffic and ensure that the CodeDeploy service role is granted lambda:InvokeFunction permissions.
The correct option is the one that changes the AppSpec lifecycle hook to AfterAllowTestTraffic and ensures that the CodeDeploy service role is granted lambda:InvokeFunction permissions. In an Amazon ECS blue/green deployment, the AfterAllowTestTraffic hook runs validation tests after test traffic is routed to the replacement task set. Additionally, the CodeDeploy service role requires permission to invoke the validation Lambda function.

Step-by-Step Solution

1
Identify the correct AWS CodeDeploy lifecycle hook for Amazon ECS.
Amazon ECS deployments support specific hooks such as BeforeInstall, AfterInstall, AfterAllowTestTraffic, BeforeAllowTraffic, and AfterAllowTraffic. The ValidateService hook is only for EC2/on-premises deployments.
Choosing the correct hook ensures CodeDeploy runs the validation tests at the correct phase of the blue/green deployment.
2
Determine the necessary IAM configuration to allow CodeDeploy to invoke the validation Lambda function.
The CodeDeploy service role requires the lambda:InvokeFunction permission. The Lambda function's execution role does not need its trust policy updated to trust CodeDeploy because CodeDeploy does not assume the Lambda role to invoke it.
Granting direct invocation permissions to the CodeDeploy service role allows it to trigger the validation Lambda function.

Key Concept

AWS CodeDeploy ECS blue/green deployment lifecycle hooks and IAM permissions
Question 44Question →

A developer is configuring the `appspec.yml` file for an AWS Lambda deployment using AWS CodeDeploy. The deployment needs to shift traffic to a new version of a function. The developer wants to run validation tests before the traffic shift starts, and a notification function after all traffic has successfully shifted. The developer begins drafting the AppSpec file as follows:

yaml
version: 0.0
Resources:
- MyLambdaFunction:
Type: AWS::Lambda::Function
Properties:
Name: "MyLambdaFunction"
Alias: "live"
CurrentVersion: "1"
TargetVersion: "2"
Hooks:
- Hook_1: "ValidationLambdaFunction"
- Hook_2: "NotificationLambdaFunction"

Which of the following lifecycle hooks are valid replacements for `Hook_1` and `Hook_2` to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: BeforeAllowTraffic; AfterAllowTraffic

Answer

BeforeAllowTraffic and AfterAllowTraffic
For AWS Lambda deployments, AWS CodeDeploy supports only two lifecycle hooks: BeforeAllowTraffic and AfterAllowTraffic. The hook BeforeAllowTraffic executes validation tasks before any traffic starts shifting, and AfterAllowTraffic executes tasks after all traffic has shifted to the new version.

Step-by-Step Solution

1
Identify the target compute platform for the CodeDeploy deployment based on the AppSpec schema.
The platform is AWS Lambda, indicated by the 'AWS::Lambda::Function' type under 'Resources'.
AWS CodeDeploy supports different lifecycle hooks depending on whether the target is EC2/On-premises, ECS, or Lambda.
2
Determine the supported lifecycle hooks for AWS Lambda deployments.
Only BeforeAllowTraffic and AfterAllowTraffic are valid lifecycle hooks for AWS Lambda in CodeDeploy.
Unlike EC2 or ECS, Lambda deployments only support hooks that run immediately before traffic shifting begins and immediately after traffic shifting completes.
3
Map the requirements (validation before shifting and notifications after shifting) to the corresponding hooks.
Hook_1 (validation before shifting) maps to BeforeAllowTraffic, and Hook_2 (notification after shifting) maps to AfterAllowTraffic.
BeforeAllowTraffic executes tasks before the first increment of traffic shifts to the new version, while AfterAllowTraffic runs after the final increment has shifted.

Key Concept

AWS CodeDeploy lifecycle hooks for AWS Lambda deployments
Estimated Time:1m 30s
Question 45Question →

A developer is configuring AWS CodeDeploy to perform in-place deployments of a web application to a fleet of Amazon EC2 instances. The deployment group is configured, but the deployments fail immediately at the start with an error indicating that CodeDeploy does not have permission to access the target instances. The developer needs to ensure that the CodeDeploy service has the necessary permissions to perform the deployment.

Which configuration change will resolve this issue?

Show answer & explanation

Answer: Update the trust policy of the CodeDeploy IAM service role to allow the codedeploy.amazonaws.com service principal to assume the role.

Answer

Updating the trust policy of the CodeDeploy IAM service role to trust the CodeDeploy service principal.
Updating the trust policy of the CodeDeploy IAM service role to allow the codedeploy.amazonaws.com service principal to assume the role is correct. CodeDeploy requires a service role with permissions to access EC2 instances and ECS services on your behalf, and this role must trust the CodeDeploy service principal so that AWS CodeDeploy can assume it using AWS Security Token Service (STS).

Step-by-Step Solution

1
Identify the service role configured for the CodeDeploy deployment group.
The specific IAM role used by CodeDeploy is identified.
Deployments require a service role with appropriate permissions to execute actions.
2
Verify the trust relationship of the identified IAM service role in the IAM console.
The trust policy is found to be missing or misconfigured for the CodeDeploy service principal.
To assume a service role, AWS CodeDeploy must be allowed in the trust policy.
3
Modify the trust policy of the IAM service role to allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.
The role's trust policy is successfully updated, allowing CodeDeploy to assume it.
This resolves the authorization failure and allows CodeDeploy to manage the deployment.

Key Concept

IAM service roles and trust policies for AWS CodeDeploy
Estimated Time:2m 0s
Question 46Question →

A development team is setting up a continuous delivery pipeline using AWS CodeDeploy for a microservice hosted on Amazon Elastic Container Service (Amazon ECS). The team wants to ensure that a validation test suite is executed immediately after the new container tasks are registered and test traffic is routed to them, but before any production traffic is shifted. Additionally, they want to execute a notification task once the production traffic has been completely transitioned.

Which actions must the developer take to achieve this deployment workflow? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define the AfterAllowTestTraffic hook in the appspec.yaml file to invoke a Lambda function that executes the validation tests.; Define the AfterAllowTraffic hook in the appspec.yaml file to invoke a Lambda function that executes the notification task.

Answer

To configure this ECS deployment workflow, the developer must define the AfterAllowTestTraffic hook in the appspec.yaml file to execute the validation tests, and define the AfterAllowTraffic hook to run the post-traffic routing notification task.
For an Amazon ECS deployment, CodeDeploy uses a specific set of hooks. The 'AfterAllowTestTraffic' hook runs after the replacement tasks are created and test traffic is routed to them, making it the ideal stage for running integration/validation tests. The 'AfterAllowTraffic' hook runs after all production traffic is shifted to the new task set, which is the correct moment to trigger a notification task confirming completion.

Step-by-Step Solution

1
Identify the target compute platform and its specific lifecycle hooks.
The platform is Amazon ECS. ECS-specific hooks must be used rather than EC2-specific ones.
AWS CodeDeploy uses distinct lifecycle hooks depending on the target compute platform.
2
Determine the correct lifecycle hook for the validation tests.
Validation tests must run after test traffic is active but before production traffic starts shifting, which matches the AfterAllowTestTraffic hook.
This hook fires as soon as the test port is serving traffic to the new task set.
3
Determine the correct lifecycle hook for post-deployment notification.
The notification must run after the shift of production traffic is completed, which corresponds to the AfterAllowTraffic hook.
This hook fires immediately after the production traffic routing is successfully fully swapped.

Key Concept

AWS CodeDeploy Lifecycle Hooks for ECS

Alternative Method

Instead of executing tests strictly in AfterAllowTestTraffic, you can also use AfterInstall to perform tests if you do not have a separate test port configured, though AfterAllowTestTraffic is the standard best practice when test traffic routing is configured.
Estimated Time:1m 30s
Question 47Question →

A developer is preparing to deploy updates to an AWS Lambda function using AWS CodeDeploy. The deployment must use a canary strategy (Canary10Percent5Minutes). The developer wants to execute a validation Lambda function to perform integration tests on the new version of the function before any production traffic is shifted to it. The deployment must also use a service role that grants CodeDeploy the necessary permissions to perform the deployment.

Which two actions should the developer take to configure this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Define the validation Lambda function under the BeforeAllowTraffic hook in the hooks section of the AppSpec file.; Attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume the role.

Answer

Define the validation Lambda function under the BeforeAllowTraffic hook in the hooks section of the AppSpec file, and attach a trust policy to the CodeDeploy service role that allows the codedeploy.amazonaws.com service principal to assume the role.
The correct options are to define the validation function in the BeforeAllowTraffic hook and configure the CodeDeploy service role trust policy. The BeforeAllowTraffic hook runs before any traffic is shifted to the new version, which allows the developer to run verification tests. The CodeDeploy service role must have a trust policy that allows codedeploy.amazonaws.com to assume the role in order to perform deployment tasks.

Step-by-Step Solution

1
Determine the correct CodeDeploy lifecycle hook for validating an AWS Lambda function before traffic starts routing to the new version.
Identify the BeforeAllowTraffic lifecycle hook as the appropriate hook.
AWS Lambda deployments support only BeforeAllowTraffic and AfterAllowTraffic hooks. BeforeAllowTraffic executes prior to any traffic shifting, which meets the requirement of verifying the function before production traffic is routed.
2
Establish the correct trust policy for the IAM service role used by CodeDeploy.
Ensure the trust policy allows the codedeploy.amazonaws.com service principal to assume the role.
AWS CodeDeploy requires permissions to interact with AWS Lambda and other services during deployment. This requires a dedicated CodeDeploy service role that explicitly trusts the CodeDeploy service principal.

Key Concept

Configuring AWS CodeDeploy for Lambda deployments using AppSpec lifecycle hooks and establishing the correct trust policy for the service role.
Question 48Question →

A developer is configuring an AppSpec file in YAML format for an AWS CodeDeploy deployment targeting Amazon ECS. The developer needs to run a validation Lambda function immediately after the replacement task set is created, but before any traffic shifts to the new version. Which of the following configurations correctly implements this requirement?

Show answer & explanation

Answer: Under the hooks section, define the AfterInstall lifecycle event and specify the ARN of the validation Lambda function.

Answer

Under the hooks section, define the AfterInstall lifecycle event and specify the ARN of the validation Lambda function.
For an Amazon ECS deployment using AWS CodeDeploy, the AppSpec file defines lifecycle hooks under the hooks section that trigger AWS Lambda functions. The AfterInstall hook is executed after the replacement task set is created but before any traffic is routed to it. This makes it the correct place to run validation tests.

Step-by-Step Solution

1
Identify the target compute platform for the CodeDeploy deployment.
The target platform is Amazon ECS, which uses an AppSpec file containing Resources and Hooks sections.
AppSpec file structures and valid lifecycle hooks differ significantly between Amazon ECS, AWS Lambda, and EC2/on-premises compute platforms.
2
Determine the correct lifecycle hook for the validation timing requirement.
The requirement is to validate after the replacement task set is created but before any traffic shifts. The AfterInstall hook corresponds to this stage.
In ECS deployments, AfterInstall is the hook that runs immediately after the new task set is provisioned.
3
Identify how validation tasks are executed on Amazon ECS.
Validation tasks are executed by specifying a Lambda function ARN under the target lifecycle hook.
Unlike EC2 deployments which run shell scripts, ECS deployments use Lambda functions to execute validation checks.

Key Concept

AWS CodeDeploy AppSpec lifecycle hooks for Amazon ECS
PreviousPage 3 / 3