Examkin

Soru

Zorluk: ZorAWS CodeDeploy

A developer is configuring a blue/green deployment for a containerized microservice on Amazon ECS using AWS CodeDeploy. The deployment must execute an AWS Lambda function to perform database migrations before the load balancer begins routing production traffic to the new task set. The database password must be rotated automatically every week. During the configuration phase, the deployment fails because of lifecycle and permission errors. Which of the following configurations will successfully execute the database migration during the deployment?

  1. A
    Specify the database migration Lambda function in the BeforeInstall hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.
  2. Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.Cevap
  3. C
    Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and modify the CodeDeploy service role's trust policy to allow the lambda.amazonaws.com service principal to assume the role.
  4. D
    Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in Systems Manager Parameter Store with automatic rotation enabled, and grant the CodeDeploy service role permissions to invoke the Lambda function.

Cevap

Specify the database migration Lambda function in the BeforeAllowTraffic hook of the AppSpec file, store the database password in AWS Secrets Manager, and grant the CodeDeploy service role permissions to invoke the Lambda function.
The configuration using the BeforeAllowTraffic lifecycle hook, AWS Secrets Manager, and proper IAM permission policies is correct because it correctly aligns with ECS-specific deployment hooks, meets the automated rotation requirements, and correctly permissions CodeDeploy to execute the validation Lambda function.

Adım Adım Çözüm

1
Identify the correct CodeDeploy lifecycle hook for ECS deployments.
BeforeAllowTraffic is identified as the valid hook because ECS deployments do not support EC2-specific lifecycle hooks like BeforeInstall.
Choosing the correct hook prevents deployment validation errors in the AppSpec file.
2
Determine the correct service for storing database credentials requiring rotation.
AWS Secrets Manager is chosen because it supports automatic rotation natively, unlike Systems Manager Parameter Store.
Meeting the requirement for weekly automatic rotation of credentials.
3
Configure the necessary IAM permissions for CodeDeploy to invoke the migration Lambda function.
Attach an identity-based policy granting lambda:InvokeFunction to the CodeDeploy service role.
Ensuring CodeDeploy has the operational permission to trigger the validation Lambda hook during deployment.

Anahtar Kavram

AWS CodeDeploy ECS lifecycle hooks, secrets management, and IAM permission vs trust policies.
Bu soruyu puanla

Konular

AWS CodeDeploy

Bu konudan daha fazla soru