DOP-C02 Exam Dumps : AWS Certified DevOps Engineer - Professional

Comprehensive and Detailed Explanation From Exact Extract of DevOps Engineer documents only:

During an Amazon ECS service deployment, if tasks fail the Elastic Load Balancing target group health checks, Amazon ECS considers those tasks unhealthy and stops and replaces them. This behavior can cause the deployment to remain incomplete because healthy replacement tasks never become available.

Also, if an essential container in the task exits, the entire task stops. Since the question states that the new tasks enter a stopped state soon after launch, an essential container failure is a direct and highly likely cause.

Why the other options are incorrect:

B. The IAM role used by the DevOps engineer to update the ECS service does not need RunTask permission for the tasks to remain running after launch. A permission issue here would more likely affect the update action itself rather than cause launched tasks to stop shortly afterward.

C. Although CloudWatch Logs configuration problems can affect logging, the missing log group is not the most likely direct reason for ECS tasks to repeatedly stop in this deployment scenario.

D. The task role provides permissions to the application code running inside the container. It is not the role primarily responsible for launching the task. Task startup is typically related to the task execution role, ECS service behavior, container health, and load balancer checks.

Step 1: Understanding Lambda Permissions and AWS Config

The custom AWS Config rule evaluates resources and invokes an AWS Lambda function when a compliance check is triggered. For AWS Config to invoke the Lambda function, it requires permission to do so.

Issue: The Lambda function fails to execute because AWS Config doesn ' t have permission to invoke it.

Action: Modify the resource-based policy of the Lambda function to grant AWS Config permission to invoke the Lambda function.

Why: Without this permission, AWS Config cannot trigger the Lambda function, which is why the evaluation fails.

 Impact of Removing FullAWSAccess and Adding Policy for EC2 Actions:

The FullAWSAccess policy allows all actions on all resources by default. Removing this policy from the Department OU will limit the permissions that accounts within this OU inherit from the parent OU.

Adding a policy that allows only Amazon EC2 API operations will restrict the permissions to EC2 actions only.

 Permissions of Administrative IAM Roles:

The administrative IAM roles in the Engineering OU have the AdministratorAccess policy attached, which grants full access to all AWS services and resources.

Since SCPs are restrictions that apply at the organizational level, removing FullAWSAccess and replacing it with a policy allowing only EC2 actions means that for all accounts in the Engineering OU:

They will have full access to EC2 actions due to the new SCP.

They will be restricted in other actions that are not covered by the SCP, hence, non-EC2 API actions will be denied.

 Conclusion:

All API actions on EC2 resources will be allowed.

All other API actions will be denied due to the absence of a broader allow policy.