Tüm alıştırma soruları

1542 soru

Tüm türler1,542 Çoktan seçmeli782 Çoklu seçim746 Sıralama14

An organization is deploying updates to a high-traffic web application hosted on AWS Elastic Beanstalk. The application is highly sensitive to performance issues, so the deployment process must maintain $100\%$ of the current instance capacity at all times. Additionally, if the new version fails health checks, the deployment must support an immediate rollback that does not alter or disrupt the active instances in the original environment. Which two Elastic Beanstalk deployment policies will meet these requirements?

Geçerli olan tümünü seçin

Immutable

Traffic Splitting

Rolling with additional batch

Rolling

All at once

Cevabı ve açıklamayı göster

Cevap: Immutable; Traffic Splitting

Cevap

The Immutable and Traffic Splitting deployment policies should be selected.

The Immutable and Traffic Splitting policies both satisfy the constraints. The Immutable policy creates a temporary Auto Scaling group to launch the new version alongside the original one. Once health checks pass, traffic is shifted. Traffic Splitting routes a configured percentage of traffic to a new temporary Auto Scaling group for evaluation. In both cases, the original instances remain untouched, maintaining

100\%

capacity and enabling instant rollback by simply deleting the temporary resources.

Adım Adım Çözüm

Analyze capacity requirements.

The strategy must maintain

100\%

capacity during deployment, which rules out All at once and Rolling strategies.

Maintaining full capacity requires launching new instances before terminating old ones.

Analyze rollback constraints.

The rollback must be immediate and must not alter or affect the running production instances if the update fails. This rules out Rolling with additional batch, which updates active instances and requires a slow rolling rollback.

To prevent disruption, the original instances must remain untouched until the new version is verified.

Select the matching Elastic Beanstalk policies.

Immutable and Traffic Splitting satisfy both constraints as they launch new instances in a temporary group and only transition traffic once verified.

Both policies keep the original instances completely intact during evaluation and allow instant cleanup/rollback upon failure.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their impact on environment capacity, duration, and rollback mechanisms.

Soru 1362Soru →

A developer is configuring an Amazon CloudWatch Logs subscription filter to stream logs from an application to an Amazon Kinesis Data Stream. The application logs are structured JSON documents that contain a root-level key `statusCode` and a nested object `errorInfo` with a key `severity`. The developer wants the subscription filter to select only log events where `statusCode` is 500 and `severity` is 'CRITICAL'. Which filter pattern must the developer use?

{

.statusCode = 500 &&

.errorInfo.severity = "CRITICAL" }

{

.statusCode == 500 AND

.errorInfo.severity == "CRITICAL" }

fields statusCode, errorInfo.severity | filter statusCode = 500 and errorInfo.severity = "CRITICAL"

[statusCode = 500, errorInfo.severity = "CRITICAL"]

Cevabı ve açıklamayı göster

Cevap: { $.statusCode = 500 &&$ .errorInfo.severity = "CRITICAL" }

Cevap

The correct filter pattern is `{

.statusCode = 500 &&

.errorInfo.severity = "CRITICAL" }`.

The correct pattern `{

.statusCode = 500 &&

.errorInfo.severity = "CRITICAL" }` properly follows the CloudWatch Logs filter pattern syntax for JSON logs. It uses curly braces, dot notation for nested JSON properties, a single `=` for comparison, and `&&` for a logical AND relationship.

Adım Adım Çözüm

Identify the format of the log events.

The log events are structured JSON documents.

This determines that the pattern must use curly braces `{ }` and JSONPath-like notation starting with `$.`.

Apply the correct comparison and logical operators for CloudWatch filter patterns.

Use `=` for equality and `&&` for the logical AND operation.

CloudWatch JSON filter patterns do not use `==` or keyword operators like `AND`.

Construct the path to the nested property.

`$.errorInfo.severity` is used to target the `severity` field inside the nested `errorInfo` object.

JSONPath syntax allows nested fields to be traversed using dot notation.

Anahtar Kavram

CloudWatch Logs Filter Pattern Syntax for JSON Log Events

Soru 1363Soru →

A developer is configuring an in-place deployment to a fleet of Amazon EC2 instances registered with an Application Load Balancer using AWS CodeDeploy. The developer needs to run a local shell script named `verify_health.sh` to confirm that the application server is responding successfully on port 8080. This verification must execute after the application has started but before the instances are reregistered with the load balancer to receive production traffic. Which lifecycle hook in the `appspec.yml` file must the developer use to run this script?

ValidateService

BeforeAllowTraffic

ApplicationStart

AfterInstall

Cevabı ve açıklamayı göster

Cevap: ValidateService

Cevap

ValidateService

The ValidateService lifecycle hook is the designated phase in EC2/On-Premises deployments to run verification scripts. It executes after the application has started (ApplicationStart) and before CodeDeploy reregisters the instances with the Application Load Balancer target group. A successful script exit code allows the deployment to proceed, while a non-zero exit code triggers an automatic rollback.

Adım Adım Çözüm

Identify the compute platform and deployment style.

Compute platform is Amazon EC2, and the deployment is an in-place update with a load balancer.

Different compute platforms (EC2 vs. ECS/Lambda) support different sets of AppSpec lifecycle hooks.

Determine which hooks support running user-defined scripts on EC2 instances.

Only specific hooks like BeforeInstall, AfterInstall, ApplicationStart, and ValidateService support script execution on EC2.

Load balancer hooks such as BeforeAllowTraffic are managed by CodeDeploy to update target group registration and cannot run user-defined scripts in the AppSpec file.

Order the lifecycle hooks to locate the correct phase after application startup but before traffic registration.

The ApplicationStart hook starts the service, followed by ValidateService to run health checks. Only after ValidateService passes does CodeDeploy proceed to BeforeAllowTraffic/AllowTraffic.

This guarantees that unhealthy instances are caught and the deployment is rolled back before they are exposed to production traffic.

Anahtar Kavram

AWS CodeDeploy AppSpec lifecycle hook execution order and capability differences between EC2/On-Premises and ECS/Lambda compute platforms.

Soru 1364Soru →

A web application hosted on `https://manager.fleet-operations.com` sends an HTTP `POST` request to an Amazon API Gateway REST API. The API is integrated with a backend AWS Lambda function using a Lambda Proxy integration. Although the developer enabled CORS on the API Gateway resource, the browser console displays a CORS preflight blocked error and a `502 Bad Gateway` status. Which two actions must the developer take to resolve these errors?

Geçerli olan tümünü seçin

Modify the Lambda function response to include the 'Access-Control-Allow-Origin' header with the value 'https://manager.fleet-operations.com'.

Ensure the Lambda function returns a structured JSON object containing the 'statusCode', 'headers', and 'body' fields.

Add a CORS configuration policy to the Amazon S3 bucket that hosts the frontend application at 'https://manager.fleet-operations.com'.

Configure an API Gateway integration response mapping template to extract the headers and format the response.

Change the API Gateway integration type to Lambda Custom integration and configure the Lambda function to return a plain text string instead of a JSON object.

Cevabı ve açıklamayı göster

Cevap: Modify the Lambda function response to include the 'Access-Control-Allow-Origin' header with the value 'https://manager.fleet-operations.com'.; Ensure the Lambda function returns a structured JSON object containing the 'statusCode', 'headers', and 'body' fields.

Cevap

To resolve the CORS and 502 Bad Gateway errors, the developer must modify the Lambda function response to include the 'Access-Control-Allow-Origin' header with the value 'https://manager.fleet-operations.com', and ensure the Lambda function returns a structured JSON object containing the 'statusCode', 'headers', and 'body' fields.

The correct options are to modify the Lambda function response to include the 'Access-Control-Allow-Origin' header with the client's origin, and ensure the Lambda function returns a structured JSON object containing 'statusCode', 'headers', and 'body'. In a Lambda Proxy integration, the backend Lambda function is responsible for both the formatting of the response payload (which prevents the 502 Bad Gateway error) and returning the necessary CORS headers.

Adım Adım Çözüm

Analyze the error context and integration type.

Identify that the API uses Lambda Proxy integration and returns both a 502 Bad Gateway error and a CORS preflight blocked error.

With Lambda Proxy integration, API Gateway expects a structured JSON output from Lambda, and does not automatically inject CORS headers into the backend response.

Fix the response payload format of the Lambda function.

Format the Lambda function's return value as a JSON object containing 'statusCode', 'headers', and 'body'.

This resolves the 502 Bad Gateway error, which is caused by a malformed response that API Gateway cannot parse.

Add the required CORS headers to the Lambda response.

Include 'Access-Control-Allow-Origin': 'https://manager.fleet-operations.com' within the 'headers' object of the Lambda response.

This resolves the CORS preflight blocked error for the actual POST request, as the proxy integration passes backend headers directly to the client.

Anahtar Kavram

CORS and Response Formatting in API Gateway Lambda Proxy Integrations

Soru 1365Soru →

A developer is configuring an AWS CodeDeploy Blue/Green deployment for a critical web application. The application runs on Amazon EC2 instances managed by an Auto Scaling group behind an Application Load Balancer. The deployment must satisfy the following constraints:

- If any issues are detected after shifting traffic to the new (Green) fleet, the application must be rolled back to the original (Blue) fleet within a $1$ -hour window.
- The rollback must be nearly instantaneous, avoiding the time required to provision new EC2 instances or initialize the application.
- To control costs, all resources from the original fleet must be automatically terminated after the $1$ -hour window if no issues are detected.

Which configuration settings in the CodeDeploy deployment group will meet these requirements?

Configure the deployment group to redirect traffic immediately, set the action on the original instances to keep them running, and specify a rerun transition wait time of

1

hour before termination.

Configure the deployment group to terminate the original Auto Scaling group immediately after traffic redirection, and set up an automatic rollback policy to launch a new Blue Auto Scaling group from the original launch template.

Configure the deployment group to perform an in-place deployment with a custom deployment configuration of CodeDeployDefault.OneAtATime, and set the rollback to trigger on CloudWatch alarms.

Configure the deployment group to use Route 53 weighted routing policy to shift traffic, and use an AWS Lambda function triggered by a CloudWatch alarm to delete the original Auto Scaling group after

1

hour.

Cevabı ve açıklamayı göster

Cevap: Configure the deployment group to redirect traffic immediately, set the action on the original instances to keep them running, and specify a rerun transition wait time of $1$ hour before termination.

Cevap

Configure the deployment group to redirect traffic immediately, set the action on the original instances to keep them running, and specify a rerun transition wait time of

1

hour before termination.

The correct configuration is to configure the deployment group to redirect traffic immediately, keep the original instances running, and specify a wait time of

1

hour. In a CodeDeploy Blue/Green deployment, keeping the original (Blue) instances running inside the original Auto Scaling group allows CodeDeploy to perform a near-instantaneous rollback if an issue is detected. If the validation timer of

1

hour expires without any rollback being triggered, CodeDeploy automatically terminates the original instances and Auto Scaling group, ensuring that costs are controlled.

Adım Adım Çözüm

Analyze the rollback requirement.

Since the rollback must be nearly instantaneous, the original (Blue) instances must remain running and active in their target group during the testing period.

If the instances are terminated, rolling back requires provisioning new EC2 instances, which takes several minutes and violates the time constraint.

Analyze the cost optimization requirement.

The original instances should not run indefinitely; they must be automatically terminated after the validation window.

This is achieved by specifying a wait time (e.g.,

1

hour) in CodeDeploy's deployment configuration settings for original instances.

Select the correct CodeDeploy configuration option.

Configure CodeDeploy to redirect traffic immediately, keep the original fleet running, and set the wait time to

1

hour.

This satisfies all constraints by preserving the instances for fast rollback while ensuring automatic cleanup after

1

hour.

Anahtar Kavram

AWS CodeDeploy Blue/Green Deployment Instance Termination Lifecycle

Soru 1366Soru →

A developer is building a web application where users must register and log in to access the system. The application needs to retrieve files from a private Amazon S3 bucket directly from the client browser and invoke private REST APIs hosted on Amazon API Gateway. Which Amazon Cognito configuration will meet these requirements with the least operational overhead?

Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and write a custom API Gateway Lambda Authorizer to manually decode and validate the User Pool JSON Web Tokens (JWTs) to secure the REST APIs.

Use a Cognito Identity Pool to manage user sign-ups, logins, and client federation. Use a Cognito User Pool to generate the temporary AWS credentials required for direct Amazon S3 bucket access, and configure an API Gateway Cognito User Pool Authorizer targeting the Identity Pool to secure the REST APIs.

Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and configure an API Gateway Cognito User Pool Authorizer using the User Pool to secure the REST APIs.

Use a Cognito User Pool to manage user sign-ups and logins, and attach an IAM policy directly to User Pool groups to authorize direct Amazon S3 bucket access. Configure an API Gateway Cognito User Pool Authorizer pointing to the groups to secure the REST APIs.

Cevabı ve açıklamayı göster

Cevap: Use a Cognito User Pool to manage user sign-ups and logins. Use a Cognito Identity Pool to exchange the User Pool tokens for temporary AWS credentials to access Amazon S3, and configure an API Gateway Cognito User Pool Authorizer using the User Pool to secure the REST APIs.

Cevap

The correct option correctly identifies the separation of concerns: using a Cognito User Pool for user authentication, a Cognito Identity Pool to authorize direct AWS resource access (S3) via temporary credentials, and a built-in Cognito User Pool authorizer to protect the API Gateway endpoints. This represents the most operationally efficient architecture.

Adım Adım Çözüm

Identify the authentication directory requirements.

Determine that user registration, sign-in, and profile directory management should be handled by an Amazon Cognito User Pool.

User Pools provide authentication, registration, and directory features for client applications.

Establish a secure mechanism for direct browser-to-S3 access.

Implement an Amazon Cognito Identity Pool configured with the User Pool as an identity provider to vend temporary, limited-privilege AWS credentials via IAM roles.

Identity Pools authorize users to access AWS resources (like S3) directly without exposing long-term credentials or routing requests through an intermediate backend.

Select the most efficient API Gateway authorizer.

Configure a native API Gateway Cognito User Pool Authorizer to secure the REST API endpoints using the tokens issued by the User Pool.

The built-in Cognito authorizer validates JWTs natively, eliminating the need to write, test, and pay for a custom Lambda authorizer function.

Anahtar Kavram

Amazon Cognito User Pools vs. Identity Pools, and API Gateway integration.

Tahmini Süre:1m 30s

Soru 1367Soru →

A legacy web application deployed on an Amazon EC2 instance writes log events in a space-delimited format to `/var/log/web-app/access.log`. The fields in the log are ordered as: `ip`, `user`, `date`, `request`, `status_code`, and `bytes`. A developer installs the unified CloudWatch agent on the instance to stream these logs to Amazon CloudWatch Logs and configures a metric filter to count the occurrences of HTTP 5xx server errors. However, after starting the agent, no log events appear in the CloudWatch Logs console. In addition, during testing, the metric filter fails to match any log events representing server errors. Which two actions should the developer take to resolve these issues? (Select TWO.)

Geçerli olan tümünü seçin

Ensure the IAM role attached to the EC2 instance profile contains permissions to perform `logs:CreateLogStream` and `logs:PutLogEvents` operations.

Update the metric filter pattern to `[ip, user, date, request, status_code >= 500 && status_code < 600, bytes]` to match status codes in the 5xx range.

Update the metric filter pattern to `[ip, user, date, request, status_code = 5*, bytes]` to catch all status codes starting with 5.

Store static AWS Access Key ID and Secret Access Key credentials in the CloudWatch agent's local credentials configuration file on the EC2 instance.

Migrate the application to AWS Lambda and configure the function timeout to 30 minutes to allow the agent to run continuously without interruption.

Cevabı ve açıklamayı göster

Cevap: Ensure the IAM role attached to the EC2 instance profile contains permissions to perform `logs:CreateLogStream` and `logs:PutLogEvents` operations.; Update the metric filter pattern to `[ip, user, date, request, status_code >= 500 && status_code < 600, bytes]` to match status codes in the 5xx range.

Cevap

Ensure the IAM role attached to the EC2 instance profile contains permissions to perform `logs:CreateLogStream` and `logs:PutLogEvents` operations, and update the metric filter pattern to `[ip, user, date, request, status_code >= 500 && status_code < 600, bytes]`.

To resolve the log streaming issue, the EC2 instance profile's IAM role must have the necessary permissions (`logs:CreateLogStream` and `logs:PutLogEvents`) to interact with CloudWatch Logs. To resolve the metric filter issue for space-delimited log files, the filter must use valid bracket syntax and standard numeric comparison operators (`status_code >= 500 && status_code < 600`) to correctly capture the 5xx HTTP status code range.

Adım Adım Çözüm

Diagnose why logs are not appearing in CloudWatch Logs by checking IAM permissions.

The CloudWatch agent requires explicit write permissions via the EC2 instance profile. Granting `logs:CreateLogStream` and `logs:PutLogEvents` enables log streaming.

Without these permissions, the agent cannot authenticate or write logs to the CloudWatch API.

Analyze the log format and construct a valid metric filter pattern for space-delimited logs.

The correct filter pattern is `[ip, user, date, request, status_code >= 500 && status_code < 600, bytes]`.

Space-delimited filters require brackets mapping to the fields, and numeric ranges must be specified with logical AND (`&&`) rather than wildcards (`*`).

Anahtar Kavram

CloudWatch Agent IAM Permissions and Space-Delimited Metric Filter Syntax

Tahmini Süre:2m 0s

Soru 1368Soru →

A developer is configuring a GitHub Actions workflow to deploy resources to an AWS account. To follow security best practices, the developer avoids using long-lived AWS credentials. Instead, they configure an OpenID Connect (OIDC) identity provider in IAM and create an IAM role named GitHubDeployRole to be assumed by the workflow.

The developer starts writing the following trust policy for the role, leaving two placeholders:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Federated": "arn:aws:iam::123456789012:oidc-provider/token.actions.githubusercontent.com"
},
"Action": "________",
"Condition": {
"StringEquals": {
"token.actions.githubusercontent.com:aud": "sts.amazonaws.com",
"________": "repo:my-organization/my-repo:ref:refs/heads/main"
}
}
}
]
}

Which two values must the developer use to replace the placeholders to establish this trust relationship securely? (Select TWO.)

Geçerli olan tümünü seçin

Set the Action element to sts:AssumeRoleWithWebIdentity

Set the second condition key to token.actions.githubusercontent.com:sub

Set the Action element to sts:AssumeRole

Set the second condition key to aws:PrincipalArn

Set the Action element to sts:AssumeRoleWithSAML

Cevabı ve açıklamayı göster

Cevap: Set the Action element to sts:AssumeRoleWithWebIdentity; Set the second condition key to token.actions.githubusercontent.com:sub

Cevap

Setting the Action element to sts:AssumeRoleWithWebIdentity and setting the second condition key to token.actions.githubusercontent.com:sub.

To configure the OIDC trust relationship, the role must trust the OIDC provider and allow the action stating sts:AssumeRoleWithWebIdentity. To secure the trust relationship and prevent any GitHub workflow from assuming the role, the policy must use the condition key specifying token.actions.githubusercontent.com:sub to restrict access to only the specific organization, repository, and branch.

Adım Adım Çözüm

Identify the authentication mechanism

OIDC federation via GitHub Actions

Since the pipeline uses OpenID Connect (OIDC) rather than SAML or standard AWS user credentials, we must use the STS action designed for web identity tokens.

Select the correct STS assume role action

sts:AssumeRoleWithWebIdentity

OIDC identity providers authenticate and request temporary security credentials using the AssumeRoleWithWebIdentity API call.

Identify the condition key to restrict repository scope

token.actions.githubusercontent.com:sub

To prevent unauthorized repositories from assuming the IAM role, the trust policy must assert a condition against the sub (subject) claim of the incoming token, which contains the repository organization, name, and branch reference.

Anahtar Kavram

IAM trust policies for OpenID Connect (OIDC) federation.

Soru 1369Soru →

A Svelte single-page application hosted on `https://dashboard.analytics-core.org` sends an HTTP `POST` request to an Amazon API Gateway REST API. The API is configured to use a Lambda proxy integration with a backend AWS Lambda function. When the application executes the request, the web browser console displays a `502 Bad Gateway` error, followed by a CORS error stating that the `Access-Control-Allow-Origin` header is missing. The developer confirms that CORS has already been enabled on the API Gateway resource for all methods. What must the developer do to resolve this error?

Modify the backend Lambda function to return a JSON response containing the `statusCode`, `headers`, and `body` fields, ensuring that the `headers` map includes `Access-Control-Allow-Origin` set to the application's domain.

Apply a CORS configuration policy directly to the Amazon S3 bucket hosting the Svelte application to permit cross-origin access from the API Gateway endpoint URL.

Switch the integration type of the API Gateway method from Lambda proxy integration to Lambda custom integration, as proxy integrations do not support returning custom HTTP headers.

Update the API Gateway method configuration to use a custom Lambda Authorizer that explicitly allows the client application's domain within the generated IAM policy.

Cevabı ve açıklamayı göster

Cevap: Modify the backend Lambda function to return a JSON response containing the `statusCode`, `headers`, and `body` fields, ensuring that the `headers` map includes `Access-Control-Allow-Origin` set to the application's domain.

Cevap

The correct response resolves the root cause by ensuring the Lambda function returns the response in the exact format required by the Lambda proxy integration. Specifically, the function must return a JSON object with `statusCode`, `headers`, and `body` fields, and the `headers` field must contain the `Access-Control-Allow-Origin` header. Because the browser receives a 502 Bad Gateway when the response is malformed, it also fails the CORS preflight check since the CORS headers are not present in the error response.

Adım Adım Çözüm

Analyze the error response and integration type.

The application receives a `502 Bad Gateway` and a missing `Access-Control-Allow-Origin` header, which is indicative of a malformed integration response in a Lambda proxy integration.

In Lambda proxy integrations, API Gateway expects the backend Lambda function to return a specific JSON format containing `statusCode`, `headers`, and `body`.

Verify backend response structure.

If the Lambda function returns a flat string or an arbitrary JSON structure, API Gateway fails to parse the response, resulting in a `502 Bad Gateway` status code.

Because API Gateway fails with a 502 error before processing the method's headers, the CORS headers set at the resource level are not sent to the client, triggering a secondary CORS error in the browser.

Format the Lambda response output.

The Lambda function is modified to return an object with a `statusCode` (e.g., 200), a `body` containing the JSON payload, and a `headers` object containing the `Access-Control-Allow-Origin` header set to the client's origin.

This satisfies both the API Gateway proxy format requirements and the browser's CORS policy checks.

Anahtar Kavram

CORS handling in API Gateway Lambda Proxy Integrations

Soru 1370Soru →

An engineering team is designing a client-side web application that integrates with an external OpenID Connect (OIDC) identity provider. Once authenticated, the web application must upload session logs directly to a specific folder within an Amazon S3 bucket (e.g., logs/{user_id}/). To minimize transfer latency and backend compute costs, the logs must be uploaded directly from the browser. Which architecture meets these requirements with the least operational overhead?

Create an IAM Role with a trust policy that allows the sts:AssumeRole action for the client application. Hardcode the IAM Role ARN in the client application, and have the client call AWS STS directly to assume the role using the OIDC token.

Configure an Amazon Cognito Identity Pool, register the OIDC provider as an authentication provider, and assign an authenticated IAM role. Use an IAM policy for this role that grants S3 write permissions to resources matching arn:aws:s3:::my-bucket/logs/${cognito-identity.amazonaws.com:sub}/*.

Configure an Amazon Cognito User Pool, register the OIDC provider as a federated Identity Provider (IdP), and configure a custom attribute to map the user ID to S3 folder access. Use the User Pool ID token directly to authenticate and authorize the client's S3 uploads.

Create an Amazon API Gateway REST API with a custom Lambda Authorizer. Have the authorizer validate the OIDC tokens, call AWS Security Token Service (STS) to generate temporary credentials, and return these credentials to the client to perform the S3 uploads.

Cevabı ve açıklamayı göster

Cevap: Configure an Amazon Cognito Identity Pool, register the OIDC provider as an authentication provider, and assign an authenticated IAM role. Use an IAM policy for this role that grants S3 write permissions to resources matching arn:aws:s3:::my-bucket/logs/${cognito-identity.amazonaws.com:sub}/*.

Cevap

Using an Amazon Cognito Identity Pool is the standard, least-overhead method to exchange external OIDC identity tokens for temporary, limited-privilege AWS credentials. The identity pool acts as the credential provider, mapping the OIDC token to an authenticated IAM role. By using the policy variable ${cognito-identity.amazonaws.com:sub}, you can dynamically restrict users to their specific folders within the S3 bucket without requiring custom backend code.

Adım Adım Çözüm

Configure an Amazon Cognito Identity Pool and configure it to trust the external OIDC identity provider.

Enables the client-side application to present OIDC tokens to Cognito in exchange for a unique Cognito Identity ID.

Identity Pools are the service component responsible for federating identity providers to authorize AWS resource access.

Assign an authenticated IAM role to the Identity Pool, representing signed-in users.

Users who present valid OIDC tokens will automatically assume this role and receive temporary AWS credentials.

IAM roles define what permissions the authenticated identity has within the AWS environment.

Apply a policy to the IAM role that uses the dynamic variable ${cognito-identity.amazonaws.com:sub} in the S3 resource ARN.

Enforces fine-grained isolation, ensuring users can only write to their own folder within the S3 bucket.

This avoids hardcoding or managing individual folders manually, providing secure and automated resource isolation.

Anahtar Kavram

Amazon Cognito Identity Pools broker temporary AWS credentials for federated users, allowing direct and secure access to AWS resources like S3 using dynamic policy variables.

Tahmini Süre:1m 30s

Soru 1371Soru →

A developer is configuring a blue/green deployment for an Amazon ECS service using AWS CodeDeploy. During the deployment process, the deployment fails with an access denied error because CodeDeploy is unable to modify the Application Load Balancer listeners and target groups. The developer verifies that the CodeDeploy service role has the AWSCodeDeployRoleForECS managed policy attached. Which configuration must the developer verify or update to resolve this deployment failure?

The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.

The permission policy of the ECS Task Execution Role, ensuring it explicitly grants the sts:AssumeRole permission for the CodeDeploy service role.

The IAM trust policy of the ECS Task Role, ensuring it lists the CodeDeploy service principal as a trusted entity.

The configurations in AWS Systems Manager Parameter Store, ensuring the CodeDeploy service role ARN is stored as a SecureString parameter and referenced in the AppSpec file.

Cevabı ve açıklamayı göster

Cevap: The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.

Cevap

The trust policy of the CodeDeploy service role, ensuring it allows the codedeploy.amazonaws.com service principal to assume the role.

The trust policy of an IAM role defines which principal (such as an AWS service or another account) is allowed to assume the role. For AWS CodeDeploy to perform deployment actions on behalf of the developer (such as updating ECS target groups), its service role's trust policy must trust the CodeDeploy service principal (codedeploy.amazonaws.com) and allow the sts:AssumeRole action. If this trust policy is missing or misconfigured, CodeDeploy cannot assume the role, resulting in an access denied error even if the role has the correct permissions attached.

Adım Adım Çözüm

Analyze the deployment error and identify that CodeDeploy failed to assume the service role despite the correct permissions policy being attached.

Recognize that the failure is related to IAM role delegation/trust rather than the permissions policy contents.

CodeDeploy must be trusted by the service role before it can assume it to perform deployment tasks on ECS resources.

Locate the CodeDeploy service role in the IAM console and inspect its trust relationships (trust policy).

Determine that the trust policy must explicitly allow the codedeploy.amazonaws.com service principal to perform the sts:AssumeRole action.

Without this trust policy, AWS Security Token Service (STS) will deny the assume role request, causing CodeDeploy to fail with an access denied error.

Anahtar Kavram

AWS CodeDeploy Service Role Trust Policy

Tahmini Süre:1m 30s

Soru 1372Soru →

A developer is using AWS SAM to deploy a serverless application. The template file (`template.yaml`) contains the following definition:

yaml
AWSTemplateFormatVersion: '2010-09-09'

Resources:
ProcessDataFunction:
Type: AWS::Serverless::Function
Properties:
Handler: index.handler
Runtime: nodejs18.x
CodeUri: ./src
Events:
GetRequest:
Type: Api
Properties:
Path: /data
Method: get

When the developer attempts to deploy the application, the deployment fails with errors indicating unrecognized resource types and invalid code locations.

Which two actions must the developer take to resolve these issues and successfully deploy the application? (Select two.)

Geçerli olan tümünü seçin

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.

Run the `sam deploy` command to package the local code, upload the zip archive to Amazon S3, and deploy the stack.

Deploy the template directly using the `aws cloudformation deploy` command without packaging the local artifacts.

Add an IAM trust policy under the `Globals` section of the template to permit Amazon API Gateway to assume the Lambda function's role.

Configure the function's code to return a raw string directly to bypass API Gateway proxy payload validation requirements.

Cevabı ve açıklamayı göster

Cevap: Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template.; Run the `sam deploy` command to package the local code, upload the zip archive to Amazon S3, and deploy the stack.

Cevap

Add the `Transform: AWS::Serverless-2016-10-31` declaration at the root level of the template, and run the `sam deploy` command to package the local code, upload the zip archive to Amazon S3, and deploy the stack.

To successfully deploy the application, the developer must first add the `Transform: AWS::Serverless-2016-10-31` statement to the template. This enables the CloudFormation service to parse and translate SAM resources. Second, because the template references a local path for the function's code (`CodeUri: ./src`), the developer must package the code and upload it to Amazon S3. The `sam deploy` command automatically handles both the packaging of local artifacts to S3 and the deployment of the generated template.

Adım Adım Çözüm

Analyze the validation errors in the CloudFormation deployment trace.

Identify that CloudFormation fails to recognize `AWS::Serverless::Function` and cannot resolve the local path `./src` for code execution.

This helps target the missing template-level processor definition and the untranslated local reference.

Add the required SAM transform statement to the template root.

The template now contains the `Transform: AWS::Serverless-2016-10-31` header, allowing the CloudFormation engine to translate SAM-specific resources into standard resources.

This is a mandatory declaration for any AWS SAM template.

Use the SAM CLI commands to upload local assets and deploy the resources.

Run `sam deploy`, which compiles, zips, and uploads the local folder to S3, replaces `CodeUri` with the S3 URI, and initiates the CloudFormation deployment.

CloudFormation does not natively support local directory uploads, so packaging via SAM is required.

Anahtar Kavram

AWS SAM template structure and deployment workflow using CLI tools

Soru 1373Soru →

A developer is configuring a canary deployment for an AWS Lambda function using AWS CodeDeploy. The deployment must run a test Lambda function to validate the deployment before shifting traffic, and another test Lambda function to run post-deployment validation checks after all traffic has been shifted to the new version. Which two configuration steps must the developer perform to meet these requirements?

Geçerli olan tümünü seçin

Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file.

Attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions, and ensure its trust policy allows the codedeploy.amazonaws.com service principal.

Define the validation Lambda functions under the BeforeInstall and AfterInstall hooks in the AppSpec file.

Modify the trust policy of the validation Lambda functions' execution role to allow codedeploy.amazonaws.com to assume the role.

Store the validation Lambda function ARNs in AWS Secrets Manager and reference them in the resources section of the AppSpec file to dynamically retrieve them during deployment.

Cevabı ve açıklamayı göster

Cevap: Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file.; Attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions, and ensure its trust policy allows the codedeploy.amazonaws.com service principal.

Cevap

Define the validation Lambda functions under the BeforeAllowTraffic and AfterAllowTraffic hooks in the AppSpec file, and attach a policy to the CodeDeploy service role that allows the lambda:InvokeFunction action on the validation Lambda functions while ensuring its trust policy allows the codedeploy.amazonaws.com service principal.

The correct options properly configure the deployment lifecycle hooks for AWS Lambda (BeforeAllowTraffic and AfterAllowTraffic) in the AppSpec file and grant the required invoke permissions to the CodeDeploy service role.

Adım Adım Çözüm

Identify the target compute platform and the required hooks.

The target is AWS Lambda. The appropriate lifecycle hooks for running validation tests before traffic shifting starts and after it completes are BeforeAllowTraffic and AfterAllowTraffic.

Choosing the correct lifecycle hooks ensures CodeDeploy triggers the validation tests at the correct points in the deployment process.

Configure the CodeDeploy service role permissions.

Ensure the CodeDeploy service role has a trust relationship with codedeploy.amazonaws.com and contains permissions for lambda:InvokeFunction targeting the test Lambda functions.

CodeDeploy must be authorized to assume its role and invoke the external Lambda functions designated as validation hooks.

Anahtar Kavram

AWS CodeDeploy lifecycle hooks for Lambda deployments and their associated IAM permissions.

Soru 1374Soru →

A developer is setting up a new AWS CodeBuild project to compile an application. The developer creates an IAM role named CodeBuildServiceRole to serve as the service role for the project and attaches policies allowing access to Amazon S3 and Amazon CloudWatch Logs. However, when the developer attempts to start the build run, it fails immediately with the following error:

CodeBuild is not authorized to perform: sts:AssumeRole on arn:aws:iam::123456789012:role/CodeBuildServiceRole

What action should the developer take to resolve this authorization failure?

Update the trust policy of CodeBuildServiceRole to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.

Add a statement to the IAM permissions policy attached to CodeBuildServiceRole that allows the sts:AssumeRole action.

Define the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables inside the buildspec.yml file to authorize CodeBuild.

Configure an Amazon Cognito Identity Pool to authenticate the CodeBuild agent and provide temporary security credentials.

Cevabı ve açıklamayı göster

Cevap: Update the trust policy of CodeBuildServiceRole to allow the codebuild.amazonaws.com service principal to perform the sts:AssumeRole action.

Cevap

Update the trust policy of the IAM service role to allow the CodeBuild service principal (codebuild.amazonaws.com) to assume the role.

The error indicates that the AWS CodeBuild service itself is not authorized to assume the role specified. For an AWS service to assume an IAM role, the role's trust policy (trust relationship) must explicitly grant 'sts:AssumeRole' permission to the service principal, in this case, 'codebuild.amazonaws.com'. Updating the trust policy resolves this failure.

Adım Adım Çözüm

Analyze the error message.

The error shows that the CodeBuild service principal is unable to assume the specified service role (sts:AssumeRole fails).

Before CodeBuild can execute, it needs to assume the role to inherit its permissions.

Inspect the trust relationship of the IAM role.

Identify that the trust policy is either missing or does not specify codebuild.amazonaws.com as a trusted entity.

The trust policy is what establishes trust between the IAM role and the AWS service principal.

Update the trust policy document.

Add a trust statement allowing the 'sts:AssumeRole' action to the 'codebuild.amazonaws.com' principal.

This grants CodeBuild the authority to assume the role successfully.

Anahtar Kavram

IAM Service Role Trust Policies

Soru 1375Soru →

A developer is configuring a CI/CD pipeline for a microservice deployed on Amazon ECS. The company requires a deployment strategy that minimizes the blast radius by shifting traffic to the new version of the application in multiple stages (either in a single initial test phase followed by a complete cutover, or in periodic increments). The deployment must also support automatic rollbacks if any CloudWatch alarms are triggered. Which two AWS CodeDeploy predefined deployment configurations can the developer use to meet these requirements?

Geçerli olan tümünü seçin

CodeDeployDefault.ECSCanary10Percent5Minutes

CodeDeployDefault.ECSLinear10PercentEvery1Minutes

CodeDeployDefault.ECSAllAtOnce

CodeDeployDefault.LambdaLinear10PercentEvery1Minute

CodeDeployDefault.ECSRollingUpdate

Cevabı ve açıklamayı göster

Cevap: CodeDeployDefault.ECSCanary10Percent5Minutes; CodeDeployDefault.ECSLinear10PercentEvery1Minutes

Cevap

CodeDeployDefault.ECSCanary10Percent5Minutes and CodeDeployDefault.ECSLinear10PercentEvery1Minutes

The configurations CodeDeployDefault.ECSCanary10Percent5Minutes and CodeDeployDefault.ECSLinear10PercentEvery1Minutes are correct because they are predefined deployment configurations for Amazon ECS. The Canary configuration routes 10% of traffic to the green task set and waits 5 minutes before routing the rest, while the Linear configuration shifts traffic in equal increments of 10% every minute. Both meet the requirement of gradual traffic shifting and support automatic rollback via CloudWatch alarms.

Adım Adım Çözüm

Filter deployment configurations by targeted service.

Identify that the target service is Amazon ECS, which eliminates Lambda-specific configurations.

AWS CodeDeploy separates predefined configurations for ECS, Lambda, and EC2/On-Premises; attempting to cross-assign them results in errors.

Evaluate the traffic routing requirement.

Identify configurations that support gradual traffic shifting (Canary or Linear) rather than an immediate cutover.

The requirement asks for shifting traffic in multiple stages or periodic increments to minimize blast radius.

Select matching predefined configurations.

Choose the configurations matching ECS canary and linear strategies.

Both configurations allow testing with a subset of traffic before full cutover and support automatic rollback via CloudWatch alarms.

Anahtar Kavram

AWS CodeDeploy deployment configurations for Amazon ECS support Canary and Linear traffic shifting to control blast radius and facilitate automatic rollbacks.

Tahmini Süre:1m 30s

Soru 1376Soru →

A telemetry ingestion application named ThermoSense logs sensor status updates to an Amazon DynamoDB table. The table is configured with provisioned write capacity and uses SensorModel as the partition key. During a firmware update deployment, the application encounters multiple ProvisionedThroughputExceededException errors. CloudWatch metrics indicate that a specific, widely deployed sensor model is generating a high volume of writes, resulting in a hot partition. Which TWO actions should the developer take to resolve the write throttling and ensure even load distribution across partitions? (Select TWO.)

Geçerli olan tümünü seçin

Modify the application logic to append a random numeric suffix to the partition key value before writing the items.

Configure the AWS SDK client to use exponential backoff and jitter for request retries.

Modify the queries to use Scan operations instead of Query operations to distribute the read requests across the table.

Increase the visibility timeout of the Amazon SQS queue that receives the telemetry messages to 12 hours.

Hardcode the AWS IAM access keys directly into the application's SDK client configuration to reduce credential resolution overhead.

Cevabı ve açıklamayı göster

Cevap: Modify the application logic to append a random numeric suffix to the partition key value before writing the items.; Configure the AWS SDK client to use exponential backoff and jitter for request retries.

Cevap

To resolve the throttling and key distribution issues, the developer should modify the application logic to append a random numeric suffix to the partition key value and configure the AWS SDK client to use exponential backoff and jitter for request retries.

The correct strategy combines database-level partition sharding and application-level retry patterns. Appending a random numeric suffix to the partition key distributes the write load across multiple database partitions, effectively dispersing the hot key bottleneck. Configuring the AWS SDK client to use exponential backoff and jitter ensures that the client application handles transient ProvisionedThroughputExceededException errors gracefully without overwhelming the database with immediate retries.

Adım Adım Çözüm

Analyze the cause of the throttling.

The CloudWatch metrics reveal that the ProvisionedThroughputExceededException is caused by a hot partition key because a single SensorModel partition is receiving an unevenly high volume of writes.

Before applying a fix, the developer must determine whether the throughput exhaustion is due to overall table limits or an uneven partition key distribution.

Implement partition key sharding (suffixing).

By appending a random numeric suffix to the hot partition key value, writes are distributed across multiple distinct partitions.

This resolves the hot key issue by spreading the write load more evenly across DynamoDB's physical partition structure.

Configure client-side error handling.

The AWS SDK is configured to handle transient throttling errors by retrying failed writes using exponential backoff and randomized jitter.

This prevents retry storms and ensures that the client application gracefully recovers when throughput limits are temporarily reached.

Anahtar Kavram

Resolving DynamoDB hot partition key bottlenecks using write sharding (random suffixing) combined with client-side retry logic (exponential backoff and jitter).

Tahmini Süre:2m 0s

Soru 1377Soru →

A React Native mobile application sends an HTTP POST request to an Amazon API Gateway REST API endpoint to update a user's profile. The API uses a Lambda proxy integration with an AWS Lambda function. Users report receiving a 502 Bad Gateway error when saving their profile updates. The developer checks the CloudWatch logs for the Lambda function and confirms it executes successfully, returning the following output:

{
"message": "Profile updated successfully",
"status": "success"
}

Which of the following explains why the application receives the 502 Bad Gateway error and identifies the correct solution?

The Lambda function response format is incorrect for a Lambda proxy integration. The developer must modify the Lambda function to return a JSON object containing an integer 'statusCode' and a stringified 'body'.

The API Gateway integration is configured to expect a custom integration response mapping. The developer must configure an Integration Response mapping template in API Gateway to map the Lambda output keys to JSON.

The API Gateway resource is missing a CORS configuration for the POST method. The developer must enable CORS on the API Gateway resource and redeploy the API.

The API Gateway execution role lacks the permissions required to invoke the Lambda function. The developer must update the Lambda function's resource-based policy to grant 'lambda:InvokeFunction' permission to API Gateway.

Cevabı ve açıklamayı göster

Cevap: The Lambda function response format is incorrect for a Lambda proxy integration. The developer must modify the Lambda function to return a JSON object containing an integer 'statusCode' and a stringified 'body'.

Cevap

The correct response points out that in a Lambda proxy integration, API Gateway expects the backend Lambda function to return a structured JSON object containing a 'statusCode' (number) and a 'body' (which must be a stringified representation of the payload). Returning a custom JSON object directly without this structure results in a 502 Bad Gateway error and a 'Malformed Lambda proxy response' entry in the API Gateway logs.

Adım Adım Çözüm

Analyze the error message and the configuration context.

The client receives a 502 Bad Gateway error, but the Lambda function executes successfully and returns a custom JSON object.

This indicates that the integration between API Gateway and Lambda is working, but API Gateway is unable to parse the returned output.

Evaluate the response requirements for the configured integration type.

Since the API uses a Lambda proxy integration, the backend Lambda function is responsible for defining the entire HTTP response, including status codes, headers, and the body.

For Lambda proxy integrations, API Gateway expects a specific structure: { 'statusCode': number, 'body': 'string', 'headers': { ... } }.

Identify the formatting issue in the Lambda function's current output.

The current output is a plain JSON object with custom keys ('message', 'status'), which causes API Gateway to fail with a malformed proxy response error.

Changing the function code to return the correct envelope with a stringified body resolves the malformed response and allows API Gateway to map it to a proper HTTP response.

Anahtar Kavram

API Gateway Lambda Proxy Integration Response Requirements

Soru 1378Soru →

A developer is planning to deploy a new version of an application on AWS Elastic Beanstalk. The application is currently running in a single production environment containing $4$ Amazon EC2 instances behind an Application Load Balancer. The deployment must meet the following constraints:
- The environment must maintain $100\%$ of its processing capacity ( $4$ active instances) during the deployment process.
- To control cost, the developer must not create a separate, duplicate Elastic Beanstalk environment or perform a DNS swap.
- The rollback process must be fully automated in the event that the new version fails application health checks.

Which Elastic Beanstalk deployment policy should the developer select?

Rolling with additional batch

Immutable

Rolling

Blue/Green environment swap

Cevabı ve açıklamayı göster

Cevap: Immutable

Cevap

The Immutable deployment policy should be selected because it maintains

100\%

capacity by deploying the new version to a temporary Auto Scaling group, automatically rolls back if health checks fail, and operates within a single Elastic Beanstalk environment.

The Immutable deployment policy satisfies all constraints. It maintains

100\%

capacity by launching a temporary Auto Scaling group with the new version alongside the original instances. If the new version fails health checks, Elastic Beanstalk automatically deletes the temporary Auto Scaling group, rolling back the deployment. Additionally, it avoids the overhead of managing a separate Elastic Beanstalk environment.

Adım Adım Çözüm

Analyze the capacity requirement during deployment.

The environment must maintain

100\%

of its processing capacity (

4

active instances) at all times.

This rules out the standard Rolling deployment policy, which takes some instances offline to update them, reducing active capacity.

Analyze the rollback requirement.

The deployment must automatically roll back to the previous version without manual intervention if health checks fail.

This rules out Rolling with additional batch, which requires a manual rollback deployment if the new version is unhealthy.

Analyze the environment management and cost constraint.

The developer must avoid creating a separate environment or performing a DNS swap.

This rules out the Blue/Green environment swap strategy, leaving the Immutable policy as the only one satisfying all constraints.

Anahtar Kavram

AWS Elastic Beanstalk deployment policies and their trade-offs regarding capacity, rollback behavior, and environment overhead.

Soru 1379Soru →

A developer is configuring a deployment group in AWS CodeDeploy to deploy an application to a fleet of Amazon EC2 instances. The developer creates a new IAM role to serve as the service role for the deployment group. However, when the deployment is initiated, it fails immediately with a service role authorization error before any lifecycle event scripts in the appspec.yml file are executed. Which configuration issue is the most likely cause of this failure?

The trust policy of the IAM role attached to the EC2 instance profile is configured to allow codedeploy.amazonaws.com to assume the role instead of ec2.amazonaws.com.

The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.

The appspec.yml file is configured with the AfterAllowTraffic lifecycle hook, which is invalid for deployments targeting the Amazon EC2 compute platform.

The deployment group is configured to fetch the application source bundle from Systems Manager Parameter Store, which is not supported because CodeDeploy requires AWS Secrets Manager for source bundle retrieval.

Cevabı ve açıklamayı göster

Cevap: The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.

Cevap

The IAM service role associated with the CodeDeploy deployment group does not have a trust policy that allows the codedeploy.amazonaws.com service principal to assume the role.

The correct option is correct because AWS CodeDeploy needs to assume the specified service role to perform operations such as registering instances, updating Auto Scaling groups, and interacting with load balancers. This trust is established via the trust policy of the role, which must explicitly allow the 'codedeploy.amazonaws.com' service principal to perform the 'sts:AssumeRole' action. If this trust policy is missing or incorrect, the CodeDeploy service cannot assume the role, and the deployment fails immediately with an authorization error.

Adım Adım Çözüm

Analyze the timing and nature of the error, noting that the deployment fails immediately with a 'service role authorization error' before CodeDeploy attempts to connect to the target instances or run any lifecycle scripts.

This indicates that the issue lies with the permissions of the CodeDeploy service itself to act on the user's behalf, rather than an agent or configuration file issue on the EC2 instances.

Before any deployment actions can be orchestrated, the AWS CodeDeploy service must successfully assume the service role associated with the deployment group.

Examine the role requirements for AWS CodeDeploy to perform deployment actions on AWS resources.

CodeDeploy requires an IAM service role with a trust policy allowing the 'codedeploy.amazonaws.com' service principal to perform 'sts:AssumeRole'.

Without this trust policy, the AWS Security Token Service (STS) will reject CodeDeploy's request to assume the role, preventing the deployment from starting.

Differentiate between the CodeDeploy service role and the EC2 instance profile role, and rule out other configuration issues.

The EC2 instance profile role is assumed by the EC2 service to allow the agent to read from S3. The AppSpec file hooks and parameter configurations are parsed much later by the agent, so failures there would not occur immediately at the start of the deployment.

This confirms that the missing trust relationship on the CodeDeploy service role is the root cause of the immediate service role authorization failure.

Anahtar Kavram

AWS CodeDeploy IAM service role and trust relationship requirements

Soru 1380Soru →

A developer is troubleshooting a Vue.js single-page application that is receiving a 502 Bad Gateway error when calling a POST endpoint on an Amazon API Gateway REST API. The API uses a Lambda proxy integration with a backend AWS Lambda function. In the Amazon CloudWatch logs, the developer confirms that the Lambda function executed successfully and returned the following JSON object:

{
"status": "success",
"data": {
"orderId": "78910"
}
}

Which of the following describes the root cause and the correct resolution for this error?

The integration is missing a mapping template in API Gateway. The developer must configure an Integration Response mapping template to transform the custom JSON keys from the Lambda output into a standard client HTTP response.

The API Gateway resource lacks CORS configuration. The developer must configure the CORS preflight response headers directly on the Amazon S3 bucket hosting the Vue.js application to allow cross-origin requests.

The Lambda proxy integration requires the function's output to be a JSON object containing an integer 'statusCode' and a stringified JSON 'body'. The developer must modify the Lambda function's response payload to return this format.

The Lambda function returned an object structure. The developer must modify the Lambda function to return the response payload as a raw, unformatted JSON string directly from the handler so API Gateway can forward it.

Cevabı ve açıklamayı göster

Cevap: The Lambda proxy integration requires the function's output to be a JSON object containing an integer 'statusCode' and a stringified JSON 'body'. The developer must modify the Lambda function's response payload to return this format.

Cevap

In a Lambda proxy integration, API Gateway expects the backend Lambda function to return a specific JSON response format containing an integer 'statusCode' and a string 'body'. If the backend Lambda function returns a custom JSON object instead of this format, API Gateway fails to parse the response and returns a 502 Bad Gateway error to the client. Modifying the Lambda function to return the correct structure resolves this integration issue.

Adım Adım Çözüm

Analyze the error message and execution logs.

The client receives a 502 Bad Gateway error, but CloudWatch logs confirm that the Lambda function completed execution successfully. This points to a communication or parsing error between API Gateway and Lambda.

Checking both client-side errors and backend logs helps distinguish between a Lambda function crash and an integration parsing failure.

Identify the integration type mapping requirements.

The API utilizes a Lambda proxy integration. Unlike custom integrations, proxy integrations do not support Integration Response mapping templates in API Gateway.

Understanding the difference between Lambda custom and Lambda proxy integrations dictates where the payload formatting must be performed.

Modify the Lambda function handler output format.

The developer updates the Lambda function to return an object structured with 'statusCode' (integer) and 'body' (stringified JSON).

API Gateway requires this specific contract to successfully construct the HTTP response for the client.

Anahtar Kavram

API Gateway Lambda Proxy Integration Response Formatting

Tahmini Süre:1m 30s

ÖncekiSayfa 69 / 78Sonraki

Tüm alıştırma soruları

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Cevap

Adım Adım Çözüm

Anahtar Kavram