Examkin

Question

Difficulty: HardDeployment Strategy Design

An enterprise is designing a deployment pipeline for a critical online transaction processing API hosted on Amazon ECS with AWS Fargate, fronted by an Application Load Balancer (ALB). The API is highly sensitive to service disruptions, and any new deployment must support an automated rollback that completes in under 60 seconds if the containerized application logs an elevated rate of HTTP 5XX errors. The development team proposes using AWS CloudFormation to manage the stack, utilizing the default ECS deployment controller with a rolling update strategy, setting the minimum healthy percent to 100% and the maximum percent to 200%. What is the primary risk associated with this proposed strategy, and what is the most effective way to redesign the deployment pipeline to meet the rollback requirements?

  1. A rolling update rollback requires CloudFormation or ECS to launch new tasks of the previous version and wait for them to pass health checks, which exceeds the 60-second target. The pipeline should be redesigned to use the AWS CodeDeploy blue/green deployment controller (CODE_DEPLOY), configuring CloudWatch alarms for ALB 5XX errors that trigger an immediate rollback by shifting traffic back to the original task set at the load balancer level.Answer
  2. B
    The rolling update strategy cannot detect application-level 5XX errors without custom integration. The pipeline should be redesigned to enable the ECS deployment circuit breaker with automatic rollback, which monitors container exit codes and health status, allowing ECS to instantly restart the previous version's stopped tasks on the Fargate infrastructure within 60 seconds.
  3. C
    A rolling update will result in a temporary capacity reduction if tasks fail, violating the zero-downtime requirement. The pipeline should be redesigned to deploy a second ECS service in the CloudFormation template, using Route 53 weighted routing policies with a low TTL (5 seconds) to shift traffic, and configuring Route 53 DNS failover to automatically route all traffic back to the primary service if the new service health check fails.
  4. D
    A rolling update rollback must be initiated manually, which prevents the 60-second automation target. The pipeline should be redesigned to use CloudFormation Rollback Triggers associated with a CloudWatch alarm for 5XX errors, allowing CloudFormation to automatically initiate a stack rollback that instantly reinstates the original task definition's configuration and routes traffic back to the active containers.

Answer

The primary risk is that rolling back an ECS rolling update requires launching new tasks of the previous version and waiting for them to pass health checks, which exceeds the 60-second target. The most effective redesign is to use the AWS CodeDeploy blue/green deployment controller (CODE_DEPLOY) with CloudWatch alarms to trigger an immediate traffic shift back to the original task set at the load balancer level.
The correct option correctly identifies that ECS rolling updates cannot meet a 60-second rollback window because rolling back requires provisioning new tasks and waiting for health checks. By using AWS CodeDeploy with the blue/green deployment controller (CODE_DEPLOY), the active tasks of the previous version (blue) are kept running and registered to their target group during the deployment. If the CloudWatch alarm for HTTP 5XX errors is breached, CodeDeploy immediately shifts traffic back to the blue target group at the ALB level, achieving rollback in seconds without provisioning new infrastructure.

Step-by-Step Solution

1
Analyze the rollback time constraint of 60 seconds for an ECS service fronted by an ALB.
Identify that a standard rolling update rollback requires provisioning new tasks of the previous task definition, which typically takes minutes due to container startup and ALB health check verification.
To evaluate if the proposed rolling update strategy meets the 60-second rollback SLA.
2
Evaluate the capabilities of the AWS CodeDeploy blue/green deployment controller (CODE_DEPLOY) for ECS.
CodeDeploy maintains two target groups (blue and green). During deployment, the blue target group remains active and serving traffic. Once the green target group is provisioned, CodeDeploy shifts traffic. If a rollback is triggered, CodeDeploy immediately updates the ALB listener to point back to the blue target group.
To determine how to achieve near-instantaneous traffic redirection for rollbacks.
3
Configure the automated rollback triggers.
Associate a CloudWatch alarm monitoring HTTP 5XX metrics on the target group with the CodeDeploy deployment group.
To ensure that rollbacks are automated and initiated immediately upon detecting service degradation.

Key Concept

ECS Blue/Green Deployments via AWS CodeDeploy
Estimated Time:2m 30s
Rate this question

Topics

Deployment Strategy Design

More questions from this topic