Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A company is designing an automated pipeline to deploy and update application configuration parameters on Amazon EC2 instances across multiple AWS accounts within an AWS Organization. The solution must support dynamic configuration updates without requiring instance recreation, enable automatic rollbacks if Amazon CloudWatch alarms detect application errors during the rollout, and use a centralized encryption key to secure the configurations at rest. Which of the following solutions meets these requirements?

  1. Store the configurations in AWS AppConfig, encrypted using a KMS customer managed key with a key policy that allows cross-account access. Deploy the configurations using an AWS AppConfig deployment strategy that monitors CloudWatch alarms and automatically rolls back if the error rate threshold is exceeded.Answer
  2. B
    Store the configurations in AWS AppConfig, encrypted using the default AWS managed KMS key (aws/appconfig) to simplify key management. Deploy the configurations using an AWS AppConfig deployment strategy that monitors CloudWatch alarms and automatically rolls back if the error rate threshold is exceeded.
  3. C
    Deploy configuration files directly to the instances using AWS CloudFormation StackSets and perform a rolling update on the Auto Scaling group. If the application's error rate spikes during the update, rely on CloudFormation's default stack rollback behavior to revert the changes on the instances.
  4. D
    Store the configurations in AWS Systems Manager Parameter Store. Attach a Service Control Policy (SCP) at the Organization root level that grants the member accounts permission to decrypt the parameter using the default AWS managed KMS key (aws/ssm), overriding local IAM policies.

Answer

Store the configurations in AWS AppConfig, encrypted using a KMS customer managed key with a key policy that allows cross-account access. Deploy the configurations using an AWS AppConfig deployment strategy that monitors CloudWatch alarms and automatically rolls back if the error rate threshold is exceeded.
AWS AppConfig is the correct service for dynamic configuration changes without redeploying instances. Because the application is distributed across multiple accounts, a KMS Customer Managed Key must be used because AWS-managed keys cannot be shared with external accounts. Additionally, AWS AppConfig supports native integration with CloudWatch alarms to monitor application health and trigger automatic rollbacks during deployments.

Step-by-Step Solution

1
Use AWS AppConfig as the configuration management tool.
Configurations are hosted centrally and can be dynamically pulled or pushed to EC2 instances without requiring instance recreation.
AWS AppConfig is designed specifically for dynamic, safe configuration deployment at runtime.
2
Create a Customer Managed Key (CMK) in AWS KMS with cross-account access permissions.
Member accounts are able to decrypt the configuration data using the central CMK.
AWS managed KMS keys (like aws/appconfig) have fixed policies that prevent them from being used for cross-account decryption.
3
Associate CloudWatch alarms to the AppConfig deployment strategy.
The configuration rollout monitors application health and triggers an automatic rollback if the error rate threshold is exceeded.
Integrating CloudWatch alarms directly into the AppConfig deployment strategy satisfies the requirement for automatic rollback during a faulty deployment.

Key Concept

Safe dynamic configuration deployment and cross-account encryption management
Estimated Time:2m 0s
Rate this question

Topics

Automating Deployment and Configuration Management