AWS Certified DevOps Engineer - Professional: Deployment Strategies & AWS CodeDeploy

This guide covers the core concepts of AWS CodeDeploy and the decision-making process for choosing deployment strategies in high-availability environments as required for the DOP-C02 exam.

Learning Objectives

• Evaluate deployment strategies (Blue/Green, Canary, Linear, All-at-Once) based on business requirements.
• Configure AWS CodeDeploy for various compute platforms including EC2, Lambda, and ECS.
• Analyze the structure and purpose of the appspec.yml file across different platforms.
• Implement automated rollbacks and health-based deployment controls.
• Integrate CodeDeploy with Auto Scaling and Elastic Load Balancing for resilient architectures.

Key Terms & Glossary

• Application: A unique identifier for the software being deployed (a container for deployment groups and revisions).
• Deployment Group: A set of individual instances or a serverless environment where the application is deployed.
• Deployment Configuration: A set of rules that determines how a deployment proceeds (e.g., speed of traffic shifting).
• Revision: A specific version of the application code, including the AppSpec file.
• AppSpec File: A YAML/JSON file that defines the deployment actions and lifecycle hooks.
• Target Revision: The version of the application you are currently deploying.

The "Big Idea"

In a DevOps culture, deployment is not just about moving code to a server; it is about mitigating risk. AWS CodeDeploy automates this process to eliminate the human error associated with manual deployments. By leveraging sophisticated traffic-shifting techniques like Blue/Green and Canary, organizations can achieve zero-downtime releases and maintain high availability even when a new code version contains bugs, as the system can automatically detect failures and revert to a "known-good" state.

Formula / Concept Box

Hierarchical Outline

1. AWS CodeDeploy Overview
   • Platform Agnostic: Supports EC2, On-premises, Lambda, and ECS.
   • Agent-Based: Requires the CodeDeploy Agent for EC2/On-premises.
2. The AppSpec File Structure
   • EC2/On-premises: Uses files, permissions, and hooks (YAML only).
   • Lambda/ECS: Defines resources and hooks for validation (YAML or JSON).
3. Deployment Strategies
   • All-at-Once: Highest risk; all targets updated simultaneously.
   • Half-at-a-Time: Maintains 50% capacity during deployment.
   • One-at-a-Time: Safest in-place method; updates targets sequentially.
4. Lifecycle Hooks & Validation
   • BeforeInstall/AfterInstall: Setup tasks.
   • ApplicationStart/ValidateService: Health checks.
   • BeforeAllowTraffic/AfterAllowTraffic: (Lambda/ECS only) Running validation Lambda functions.

Visual Anchors

Blue/Green Traffic Shifting

Deployment Lifecycle Timeline (EC2)

Definition-Example Pairs

• Immutable Deployment: A strategy where servers are never modified; instead, new servers are built from a fresh image.
  • Example: Using a Blue/Green deployment where the "Green" environment is a brand-new Auto Scaling group.
• Mutable Deployment: A strategy where existing servers are updated in place.
  • Example: Running an In-Place deployment where CodeDeploy SSHs into your existing EC2 instances to pull the latest git commit.
• Traffic Shifting: The process of gradually moving network requests from one version of a service to another.
  • Example: A Canary deployment that moves 10% of users to a new Lambda function version for 15 minutes before moving the remaining 90%.

Worked Examples

Example 1: ECS Blue/Green Deployment

Scenario: You need to update an ECS service with zero downtime. You must run a validation test before users see the new version.

1. Step 1: Define two target groups (TG1 for Blue, TG2 for Green) in an ALB.
2. Step 2: Update the appspec.yaml to include a BeforeAllowTraffic hook pointing to a Lambda function.
3. Step 3: Trigger deployment. CodeDeploy creates a new Task Set (Green).
4. Step 4: The BeforeAllowTraffic Lambda runs a CURL command against the Green Task Set's private IP.
5. Step 5: If the Lambda returns Succeeded, CodeDeploy swaps the ALB listener rules to point to TG2.

Example 2: Handling Auto Scaling Integration

Scenario: An Auto Scaling Group (ASG) scales out during a deployment.

1. Observation: CodeDeploy is integrated with ASG via lifecycle hooks.
2. Action: When a new instance is launched by the ASG, it enters a Pending:Wait state.
3. Result: CodeDeploy automatically installs the latest successful revision onto the new instance before it is marked InService in the load balancer.

Checkpoint Questions

1. Which compute platform supports both In-Place and Blue/Green deployments? (Answer: EC2/On-premises)
2. What is the mandatory file name for the deployment instructions in the root of your revision? (Answer: appspec.yml or appspec.json)
3. In a Lambda deployment, what hook is used to perform health checks before the traffic is shifted? (Answer: BeforeAllowTraffic)
4. True or False: All-at-Once deployments provide the highest availability. (Answer: False; they incur downtime as all instances are updated simultaneously)

Muddy Points & Cross-Refs

• Rollback Behavior: By default, CodeDeploy does not roll back on failure. You must explicitly configure the deployment group to "Roll back when a deployment fails" or "Roll back when a CloudWatch alarm threshold is met."
• Agent Connectivity: For on-premises servers, the CodeDeploy agent must be able to reach AWS public endpoints (port 443). This is a common troubleshooting point.
• IAM Permissions: The CodeDeploy Service Role (allows CodeDeploy to talk to AWS services) is different from the IAM Instance Profile (allows the EC2 instance to pull artifacts from S3).

Comparison Tables

Canary vs. Linear (Lambda/ECS)

AppSpec: EC2 vs. Lambda