Examkin

Question

Difficulty: MediumAutomating Deployment and Configuration Management

A financial services company runs a high-throughput transaction processing application on a fleet of Amazon EC2 instances within an Auto Scaling group. The application reads its feature flags and runtime configurations from a local file on each instance. The operations team needs to automate the management and deployment of these configuration updates. The solution must support validating the configuration syntax before deployment, gradually rolling out the configuration updates to the instances over a period of 1515 minutes, and automatically rolling back the deployment if application error rates spike during the rollout. Additionally, the configuration update must be applied with zero downtime and without terminating or launching any EC2 instances. Which approach should a solutions architect recommend to meet these requirements with the least operational overhead?

  1. A
    Store the configurations in AWS Systems Manager Parameter Store. Create an AWS Systems Manager State Manager association to run a custom Systems Manager Document every 1515 minutes that pulls the parameter values and overwrites the local configuration file on all instances. Deploy an AWS Lambda function triggered by CloudWatch alarms to restore the previous parameter version in Parameter Store if error rates spike.
  2. B
    Use AWS CloudFormation StackSets to manage the configuration files. Store the configuration files in an Amazon S3 bucket, update the Auto Scaling group launch template with the new S3 file path in the UserData, and perform an Instance Refresh to roll out the updates. Configure StackSets automatic rollback on CloudWatch alarms.
  3. Use AWS AppConfig. Store the configurations in an AppConfig hosted configuration store and configure a JSON schema validator. Deploy the configuration using a custom deployment strategy that defines a 1515-minute rollout duration and associates a CloudWatch alarm for application error rates as the bake time monitor. Run the AWS AppConfig Agent on the EC2 instances to retrieve and apply the configuration updates.Answer
  4. D
    Use AWS Config rules to monitor the local configuration files. When a change is detected, trigger an AWS Systems Manager Automation runbook using an AWS-managed KMS key (aws/ssm) to run a script that updates the files. Modify the key policy of the aws/ssm key to allow the cross-account validation Lambda function to decrypt the configuration payload.

Answer

Use AWS AppConfig, configure a JSON schema validator, deploy using a custom deployment strategy with a 15-minute rollout and CloudWatch alarm monitoring, and use the AWS AppConfig Agent on the instances.
AWS AppConfig is designed specifically for dynamic runtime configuration management. It natively supports syntax validation (using JSON schema, Lambda, or other validators), gradual rollout strategies (linear or exponential), and automatic rollbacks based on CloudWatch alarms during a specified bake time without terminating or launching new EC2 instances. Using the AWS AppConfig Agent on the instances minimizes the operational overhead of retrieving and applying configuration updates.

Step-by-Step Solution

1
Filter deployment methods based on the constraint to apply configuration updates without terminating or launching new EC2 instances.
Eliminates CloudFormation StackSets with launch templates and Instance Refresh, which require instance replacement.
The scenario requires zero-downtime updates without replacing infrastructure.
2
Evaluate configuration validation, rollout speed, and automatic rollback capabilities.
Identifies that AWS AppConfig provides native hosted configurations, JSON schema validators, and custom deployment strategies with bake times and CloudWatch alarm integration.
Systems Manager State Manager applies configurations simultaneously and lacks native pre-deployment validation, which fails to meet the requirement for a gradual rollout and validation.
3
Verify key policy and encryption delegation rules.
Confirms that AWS-managed KMS keys do not support policy modification, ruling out any solutions that attempt to edit the key policy of aws/ssm.
AWS-managed KMS keys are not customizable; cross-account or custom key policies require customer-managed keys.

Key Concept

AWS AppConfig for dynamic configuration deployment and validation
Estimated Time:2m 0s
Rate this question

Topics

Automating Deployment and Configuration Management