Examkin

Question

Difficulty: HardAutomating Deployment and Configuration Management

An enterprise manages its multi-account environment using AWS Organizations. The central platform team maintains a dedicated CI/CD tooling account, while applications run in separate member accounts. A critical microservice hosted on Amazon ECS (Fargate) in a member application account needs its deployment process automated.

The platform team designs a cross-account pipeline in the tooling account using AWS CodePipeline. The pipeline builds the container image, pushes it to Amazon ECR, and triggers AWS CodeDeploy in the member application account to perform a blue/green deployment. The deployment must meet these requirements:
- Shift 10%10\% of traffic to the new version, wait exactly 1010 minutes, and then shift the remaining 90%90\% of traffic.
- Automatically roll back the deployment if the HTTP 5XX5\text{XX} error count on the production listener spikes during traffic shifting.
- Maintain a secure, cross-account artifact sharing model with minimal operational overhead.

Which configuration will meet these requirements?

  1. A
    Encrypt the S3 artifact bucket in the tooling account with a Customer Managed Key (CMK). Grant the cross-account execution role in the application account decrypt and read permissions on the CMK and S3 bucket. In the application account, configure the CodeDeploy deployment group to use the predefined ECSLinear10PercentEvery1Minute deployment configuration, and associate the deployment group with a CloudWatch alarm monitoring HTTPCode_Target_5XX_Count on the Application Load Balancer's production listener.
  2. Encrypt the S3 artifact bucket in the tooling account with a Customer Managed Key (CMK). Grant the cross-account execution role in the application account decrypt and read permissions on the CMK and S3 bucket. In the application account, create a custom CodeDeploy deployment configuration with a traffic routing type of TimeBasedCanary, a CanaryPercentage of 10%, and a CanaryInterval of 10 minutes. Associate the CodeDeploy deployment group with a CloudWatch alarm monitoring HTTPCode_Target_5XX_Count on the Application Load Balancer's production listener.Answer
  3. C
    Encrypt the S3 artifact bucket in the tooling account with the default AWS-managed KMS key (aws/s3). Grant the cross-account execution role in the application account read permissions on the S3 bucket. In the application account, create a custom CodeDeploy deployment configuration with a traffic routing type of TimeBasedCanary, a CanaryPercentage of 10%, and a CanaryInterval of 10 minutes. Associate the CodeDeploy deployment group with a CloudWatch alarm monitoring HTTPCode_Target_5XX_Count on the Application Load Balancer's production listener.
  4. D
    Encrypt the S3 artifact bucket in the tooling account with a Customer Managed Key (CMK). Apply a Service Control Policy (SCP) to the Organizational Unit of the application account that allows the cross-account execution role to access the S3 bucket and decrypt using the CMK. In the application account, create a custom CodeDeploy deployment configuration with a traffic routing type of TimeBasedCanary, a CanaryPercentage of 10%, and a CanaryInterval of 10 minutes. Associate the CodeDeploy deployment group with a CloudWatch alarm monitoring HTTPCode_Target_5XX_Count on the Application Load Balancer's production listener.

Answer

The correct solution encrypts the central S3 bucket using a Customer Managed Key (CMK), grants the member account's cross-account execution role explicit read and decrypt permissions, creates a custom CodeDeploy deployment configuration of type TimeBasedCanary with a 10% percentage and 10-minute interval, and configures a CloudWatch alarm on the load balancer's production listener HTTPCode_Target_5XX_Count metric.
The correct solution resolves the cross-account encryption requirements by using a Customer Managed Key (CMK) with appropriate resource-level permissions (since AWS-managed keys cannot be shared). It handles the custom traffic shifting rules by creating a custom CodeDeploy configuration of type TimeBasedCanary (shifting 10% and pausing for 10 minutes). Finally, it monitors the Production Listener for HTTP 5xx errors using a CloudWatch alarm linked to the deployment group, achieving automated rollback.

Step-by-Step Solution

1
Configure artifact encryption and cross-account access rules.
Encrypt the central S3 bucket in the tooling account with a Customer Managed Key (CMK) instead of the default AWS-managed key, update the CMK key policy to allow key access to the member account's IAM role, and configure the S3 bucket policy to allow the member role read permissions.
Default AWS-managed keys cannot be shared across different accounts because their key policies cannot be modified.
2
Define custom traffic routing behavior in CodeDeploy.
Create a custom deployment configuration in the member account with traffic routing set to TimeBasedCanary, specifying a CanaryPercentage of 10% and a CanaryInterval of 10 minutes.
The standard pre-defined canary configurations in CodeDeploy do not include a 10-minute wait interval (only 5-minute and 15-minute intervals exist), requiring a custom configuration.
3
Set up automated rollback monitoring.
Configure a CloudWatch alarm based on HTTPCode_Target_5XX_Count on the Application Load Balancer's production listener and map it to the CodeDeploy deployment group's alarm triggers.
This guarantees that if errors spike on the shifted traffic stream, CodeDeploy will detect the alarm status and automatically roll back the deployment.

Key Concept

Cross-account IAM and KMS permissions coupled with custom deployment configuration design for automated Blue/Green rollbacks.
Rate this question

Topics

Automating Deployment and Configuration Management