AWS Certified Developer – Associate (DVA-C02)

C. Configure CodeBuild caching to an Amazon S3 bucket.

CodeBuild caching to an Amazon S3 bucket is the most effective and managed solution for reusing dependencies. It allows CodeBuild to store and retrieve build artifacts and dependencies, significantly reducing build times for subsequent builds by avoiding redundant downloads.

C. AWS CloudFormation stack update

For serverless applications defined using Infrastructure as Code (like AWS SAM or raw CloudFormation), the deployment involves creating or updating a CloudFormation stack. CodePipeline's CloudFormation action type is specifically designed to manage these stack operations, ensuring all resources are provisioned and updated consistently.

C. Configure the CodePipeline's source stage to use an AWS CodeCommit repository with event-based change detection.

CodePipeline's source stage has direct integration with CodeCommit. By selecting CodeCommit as the source provider and enabling 'Start the pipeline on source code change', CodePipeline will automatically detect new pushes to the configured branch and initiate a new pipeline execution, making it the most efficient and native solution.

C. ValidateService hook to run comprehensive health checks and trigger rollback on failure.

The ValidateService lifecycle event hook is specifically designed for running comprehensive health checks and validation tests after the application has started on the new deployment, but before any traffic is directed to it. If the scripts executed during this hook fail, CodeDeploy can be configured to automatically roll back the deployment, ensuring that only healthy instances receive traffic.

D. AWS CodeBuild action

AWS CodeBuild can be used to run custom commands, including AWS CLI commands. A CodeBuild action in CodePipeline can execute the `aws cloudfront create-invalidation` command to invalidate the CloudFront distribution after new content is deployed to S3.

D. Blue/Green deployment with a `BeforeAllowTraffic` hook for schema changes.

Blue/Green deployment in CodeDeploy creates a completely new set of instances (green environment), deploys the new application, and allows for pre-traffic hooks (`BeforeAllowTraffic`) to run database schema changes on the new environment before traffic is cut over. This ensures zero downtime and provides an automatic rollback to the old (blue) environment if issues arise during or after the traffic shift.

B. Canary

The requirements of gradually shifting traffic, monitoring for errors, automatic rollback, and testing with a small percentage of production traffic are all hallmarks of a Canary deployment strategy. CodeDeploy supports Canary deployments for Lambda functions.

B. CodeDeployDefault.LambdaCanary10Percent5Minutes

The CodeDeployDefault.LambdaCanary10Percent5Minutes configuration shifts 10% of traffic to the new Lambda function version for 5 minutes, then shifts the remaining 90%. This aligns with the requirement to route a small percentage of traffic for monitoring before a full shift.

C. BeforeInstall

The `BeforeInstall` lifecycle event hook in CodeDeploy runs after the application revision files are downloaded to the instance but before any installation or dependency resolution processes begin. This makes it the ideal place to execute a custom script that needs to run on the raw copied files before they are 'installed' or the application starts.

A. Integrate AWS CodeCommit with AWS CodePipeline, configuring the source stage to use the `main` branch as a trigger.

AWS CodePipeline natively integrates with AWS CodeCommit. By configuring the CodePipeline source stage to point to the `main` branch of the CodeCommit repository, CodePipeline will automatically detect new commits (including those from merged pull requests) and trigger the pipeline, initiating the build and test stages.

A. Deploy the Lambda function inside a VPC, configure VPC endpoints for S3 and DynamoDB, and attach an IAM policy with least privilege access to the specific resources.

To restrict network access and enforce least privilege, the Lambda function should be deployed within a VPC. To allow access to S3 and DynamoDB without traversing the public internet, VPC endpoints (Gateway Endpoint for S3, Interface Endpoint for DynamoDB) are necessary. Finally, an IAM policy must be attached to the Lambda's execution role, granting only the required permissions to the specific S3 buckets and DynamoDB table.

D. Use the output artifact from a CodeBuild stage (which builds and pushes the image) as input to a subsequent ECS deployment action, dynamically replacing the image tag in the task definition.

CodeBuild can output a JSON file containing the ECR image URI and tag after building and pushing a Docker image. This output artifact can then be used as input to an ECS deployment action. The ECS deployment action in CodePipeline has a feature to dynamically replace the image tag within an ECS task definition file using values from the input artifact, ensuring the latest image is always used.

B. Configure the Lambda function to run inside the VPC, assign it to a private subnet, and create VPC interface endpoints for S3 and DynamoDB.

To connect to RDS in a private subnet and access other AWS services privately, the Lambda function must be configured to run within the VPC in a private subnet. VPC interface endpoints for S3 and DynamoDB ensure that traffic to these services remains within the AWS network, enhancing security and reducing latency.

C. ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, ecr:BatchCheckLayerAvailability, ecr:InitiateLayerUpload, ecr:UploadLayerPart, ecr:CompleteLayerUpload, ecr:PutImage

To pull images, CodeBuild needs `GetDownloadUrlForLayer`, `BatchGetImage`, and `BatchCheckLayerAvailability`. To push images, it needs `InitiateLayerUpload`, `UploadLayerPart`, `CompleteLayerUpload`, and `PutImage`. These permissions cover the full lifecycle of pulling and pushing Docker images to and from ECR.

D. Amazon S3 caching using a dedicated S3 bucket.

Amazon S3 caching is the recommended approach for persistent caching across multiple CodeBuild projects and build runs. It allows CodeBuild to store and retrieve dependencies in an S3 bucket, making them available for subsequent builds, significantly reducing download times for unchanging dependencies. Local caching is instance-specific and non-persistent, while Docker layer caching is for Docker images, not general dependencies.

A. Lambda aliases

Lambda aliases are pointers to specific Lambda function versions. When integrated with API Gateway stages, aliases allow you to map an API Gateway stage (e.g., 'prod' or 'beta') to a specific Lambda alias, which in turn can be configured to split traffic between two Lambda function versions, enabling canary deployments or A/B testing.

B. Define a custom CodeDeploy Linear deployment strategy with multiple traffic shift steps and integrate Lambda functions as hooks (e.g., AfterAllowTraffic) to run tests after each shift.

CodeDeploy's Linear deployment strategies allow for traffic to be shifted in specified percentages over defined intervals. By defining a custom Linear strategy with multiple steps (e.g., 10%, 50%, 100%), and integrating Lambda functions as AfterAllowTraffic hooks, automated tests can be executed after each incremental traffic shift. This approach ensures the new version is validated at each stage before full traffic cutover.

B. Utilize a CodeDeploy action with a Blue/Green deployment strategy for ECS, configuring a pre-traffic hook for schema migrations.

AWS CodeDeploy with a Blue/Green deployment strategy for Amazon ECS is specifically designed to handle this scenario. The pre-traffic hook allows custom scripts (like database schema migrations) to run on the new task set before traffic is shifted. If the hook fails or an alarm is triggered, CodeDeploy can automatically roll back to the old task set, ensuring data integrity and application availability.

B. Reference the Parameter Store parameters in the `buildspec.yml` file using the `parameter-store` syntax, ensuring the CodeBuild service role has `ssm:GetParameters` permissions.

AWS CodeBuild natively integrates with AWS Systems Manager Parameter Store. By referencing parameters using the `parameter-store` syntax in the `buildspec.yml` file, CodeBuild can securely fetch these values at build time. It's crucial that the CodeBuild service role has `ssm:GetParameters` permissions to access the specified parameters.

A. Enable caching for the CodeBuild project.

Enabling caching for CodeBuild projects allows frequently accessed dependencies and Docker layers to be stored and reused across builds. This significantly reduces download times for subsequent builds, directly addressing the identified bottleneck.

B. Store them in AWS Systems Manager Parameter Store and reference them in the buildspec.yml.

AWS Systems Manager Parameter Store allows storing sensitive data securely. CodeBuild can then retrieve these parameters at build time by referencing them in the buildspec.yml file, ensuring they are not exposed in logs or source code.

C. ValidateService hook in the AppSpec file

The ValidateService hook is specifically designed for running tests and validating the health of the newly deployed application after it has started and is serving traffic. This is the ideal place for integration tests.

A. AWS CodeDeploy Agent

To enable AWS CodeDeploy to deploy applications to Amazon EC2 instances or on-premises servers, the AWS CodeDeploy agent must be installed on those target instances. This agent is responsible for downloading application revisions, running deployment scripts, and reporting deployment status back to CodeDeploy.

A. AWS Serverless Application Model (SAM)

AWS Serverless Application Model (SAM) is an open-source framework specifically designed for building serverless applications on AWS. It extends AWS CloudFormation, providing a simplified syntax for defining serverless resources like Lambda functions, API Gateway, and DynamoDB tables, and supports consistent deployment across environments.

B. Blue/green deployment

Blue/green deployment is ideal for scenarios requiring extensive testing and easy rollback. It deploys the new version to a separate set of instances (green environment) while the old version (blue environment) remains active. Once verified, traffic is shifted, and the old environment can be terminated or kept for rollback.