Examkin

Question

Difficulty: HardDeployment Strategies and Execution

A company runs a critical microservice on Amazon ECS using the AWS Fargate launch type behind an Application Load Balancer (ALB). A SysOps administrator is configuring a Blue/Green deployment using AWS CodeDeploy. The deployment must satisfy the following conditions:
- The new task definition version must be deployed and validated using a dedicated test listener port before routing production traffic.
- Production traffic must be shifted to the new version gradually over 10 minutes, with 10% shifted every minute.
- CodeDeploy must have the authority to update the ECS service and run tasks with the required task execution role.

Which combination of actions must the SysOps administrator take to meet these requirements? (Select TWO.)

  1. Configure the CodeDeploy deployment group to use the CodeDeployDefault.ECSLinear10PercentEvery1Minute traffic shifting configuration, and specify a test listener port on the Application Load Balancer.Answer
  2. Attach a policy to the CodeDeploy service role that grants the iam:PassRole permission for the ECS task execution role and task role.Answer
  3. C
    Configure the ECS service to use the ECS rolling update deployment controller type, setting the minimum healthy percent to 100% and maximum percent to 200%.
  4. D
    Update the Amazon Route 53 alias record pointing to the Application Load Balancer to use a weighted routing policy that shifts traffic gradually over 10 minutes.
  5. E
    Add the sts:AssumeRole permission for the ECS task execution role to the trust relationship policy document of the CodeDeploy service role.

Answer

To satisfy the deployment requirements, the administrator must configure the CodeDeploy deployment group with the CodeDeployDefault.ECSLinear10PercentEvery1Minute traffic shifting option and specify a test listener port on the Application Load Balancer. Additionally, the administrator must attach a policy to the CodeDeploy service role that grants the iam:PassRole permission for the ECS task execution role and task role.
To perform an ECS Blue/Green deployment using CodeDeploy, a deployment group must define the traffic shifting style (such as CodeDeployDefault.ECSLinear10PercentEvery1Minute) and target group configuration. To validate the replacement tasks before routing production traffic, a test listener port is configured. Furthermore, CodeDeploy needs authorization to pass the ECS task execution role and task role to the Amazon ECS service during task creation, which requires the iam:PassRole permission in the CodeDeploy service role's permissions policy.

Step-by-Step Solution

1
Determine the deployment control method and validation mechanism.
Identify that AWS CodeDeploy must be used with a linear traffic shifting setting (ECSLinear10PercentEvery1Minute) and a test listener port on the Application Load Balancer.
This meets the requirements of shifting traffic 10% per minute and verifying the new version prior to redirecting production traffic.
2
Verify required IAM permissions for CodeDeploy to interact with ECS.
Determine that CodeDeploy must be allowed to pass the ECS task execution role and task role to the ECS service using the iam:PassRole permission.
When CodeDeploy updates the ECS service with the new task definition, it acts on behalf of the administrator and requires permission to pass the associated roles.
3
Identify why other options do not meet the criteria.
Rule out rolling updates as they lack native blue/green traffic shifting; rule out Route 53 routing since DNS cannot target ALB-managed ECS tasks individually; and rule out trust relationship modifications as they do not replace standard iam:PassRole policies.
Eliminating invalid configurations confirms the two correct actions.

Key Concept

ECS Blue/Green Deployments with AWS CodeDeploy and Identity and Access Management (IAM) permissions
Rate this question

Topics

Deployment Strategies and Execution

More questions from this topic