Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A platform team is automating the deployment of a microservice on Amazon ECS (Fargate) across multiple AWS accounts. The CI/CD pipeline is hosted in a centralized tooling account using AWS CodePipeline. The pipeline must deploy the microservice to a production account using AWS CodeDeploy with a canary strategy that shifts 10% of traffic immediately, waits for 15 minutes, and then shifts the remaining 90% of traffic if no alarms are triggered. The deployment must automatically roll back if any Amazon CloudWatch alarms are triggered in the production account during the deployment. The pipeline artifact S3 bucket in the tooling account is encrypted. Which configuration should the platform team implement to meet these requirements securely and automatically?

  1. Configure the AWS CodeDeploy deployment group in the production account with the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration and specify the production CloudWatch alarms for rollback. Encrypt the S3 artifact bucket in the tooling account using a customer managed AWS KMS key, and configure the KMS key policy to allow the cross-account CodeDeploy execution role to decrypt the artifacts.Answer
  2. B
    Configure the AWS CodeDeploy deployment group in the production account with the CodeDeployDefault.ECSLinear10PercentEvery15Minutes deployment configuration and configure an AWS Lambda function to monitor production CloudWatch alarms and manually call the StopDeployment API. Encrypt the S3 artifact bucket in the tooling account using a customer managed AWS KMS key, and configure the KMS key policy to allow the cross-account CodeDeploy execution role to decrypt the artifacts.
  3. C
    Configure the AWS CodeDeploy deployment group in the production account with the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration and specify the production CloudWatch alarms for rollback. Encrypt the S3 artifact bucket in the tooling account using the default AWS-managed S3 key (aws/s3), and configure an IAM policy on the production account's CodeDeploy execution role to decrypt the artifacts.
  4. D
    Configure AWS CloudFormation StackSets to deploy the task definition and service directly to the production account. Use a rolling deployment strategy by updating the stack, and configure an administrator to manually revert the task definition to the previous version in the Amazon ECS console if production CloudWatch alarms are triggered. Encrypt the S3 artifact bucket in the tooling account using a customer managed AWS KMS key.

Answer

Configure the AWS CodeDeploy deployment group in the production account with the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration and specify the production CloudWatch alarms for rollback. Encrypt the S3 artifact bucket in the tooling account using a customer managed AWS KMS key, and configure the KMS key policy to allow the cross-account CodeDeploy execution role to decrypt the artifacts.
The correct configuration uses the CodeDeployDefault.ECSCanary10Percent15Minutes deployment configuration, which shifts 10% of traffic immediately and the remaining 90% after 15 minutes, fulfilling the canary deployment requirements. It also uses a customer managed KMS key to encrypt S3 artifacts because default AWS-managed KMS keys do not support policy modification and cannot be used for cross-account decryption by the production account's role.

Step-by-Step Solution

1
Select the deployment configuration in CodeDeploy.
CodeDeployDefault.ECSCanary10Percent15Minutes is selected to shift 10% of traffic immediately and the remaining 90% after 15 minutes.
This matches the target traffic shifting pattern for the canary deployment strategy.
2
Configure cross-account S3 artifact decryption using a customer managed KMS key.
The S3 bucket in the tooling account is encrypted with a customer managed KMS key, and the key policy grants decrypt permissions to the production account role.
AWS-managed KMS keys do not support key policy modifications and cannot be shared across accounts, necessitating a customer managed key.
3
Associate CloudWatch alarms with the CodeDeploy deployment group.
Native automatic rollback triggers are configured when production CloudWatch alarms enter the ALARM state.
This automates rollback handling without custom Lambda scripting or manual console intervention.

Key Concept

Cross-account deployment automation and KMS key delegation in AWS CodePipeline and AWS CodeDeploy.
Estimated Time:2m 0s
Rate this question

Topics

Automating Deployment and Configuration Management