Examkin

Soru

Zorluk: OrtaAWS CodeDeploy

A developer is configuring AWS CodeDeploy to deploy a web application to a fleet of Amazon EC2 instances. The deployment must copy application files to the target instances and run a shell script (scripts/initialize.sh) that installs application dependencies. During execution, this script must download a configuration file from a secured Amazon S3 bucket.

Which two options must the developer configure to meet these requirements? (Select TWO.)

  1. Define the script path and execution settings under the AfterInstall lifecycle hook in the hooks section of the appspec.yml file.Cevap
  2. Attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.Cevap
  3. C
    Define the script path and execution settings under the BeforeAllowTraffic lifecycle hook in the hooks section of the appspec.yml file.
  4. D
    Attach an IAM policy to the CodeDeploy service role that allows the s3:GetObject action on the target S3 bucket.
  5. E
    Store the configuration file in AWS Secrets Manager and grant the CodeDeploy service role permission to rotate the secret during the ValidateService hook.

Cevap

Define the script path and execution settings under the AfterInstall lifecycle hook in the appspec.yml file, and attach an IAM instance profile to the Amazon EC2 instances with a policy that allows the s3:GetObject action on the target S3 bucket.
The correct options are to define the script execution under the AfterInstall hook in the appspec.yml file and to attach an S3 read permission policy to the EC2 instance profile. The AfterInstall hook is a standard EC2 deployment lifecycle hook suitable for post-installation tasks like installing dependencies. Because the CodeDeploy agent runs directly on the EC2 instances, any commands executed by the agent (such as scripts in the hooks section) run under the security context of the EC2 instance. Therefore, the instance profile attached to the EC2 instances must have permissions to access the S3 bucket.

Adım Adım Çözüm

1
Determine the correct lifecycle hook for the EC2 deployment script.
The AfterInstall hook is selected as the appropriate hook to run dependency installation scripts after the application bundle has been copied.
EC2 deployments use specific lifecycle hooks like BeforeInstall, Install, AfterInstall, and ApplicationStart. The script must run after files are copied.
2
Determine the proper IAM credentials configuration for script execution.
The EC2 instance profile must be granted the s3:GetObject permission.
Scripts executed by the CodeDeploy agent run on the EC2 instance itself and use the instance's IAM role (instance profile) to authenticate to S3, not the CodeDeploy service role.

Anahtar Kavram

Understanding AWS CodeDeploy EC2 lifecycle hooks and how IAM permissions are resolved for scripts executed by the CodeDeploy agent on EC2 instances.
Bu soruyu puanla

Konular

AWS CodeDeploy

Bu konudan daha fazla soru