DOP-C02 practice question: Troubleshooting failed deployments and stacks (2 of 3)

Incident and Event Response A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

A SaaS startup runs its billing API as an Amazon ECS service on AWS Fargate. After a new task definition was registered, the service's deployment stopped at 50 percent, and new tasks show as STOPPED within seconds of starting.

The stopped tasks report a ResourceInitializationError that says the task could not retrieve a secret from AWS Secrets Manager. The secret is referenced in the container definition and was created last week by the platform team.

The team needs the service to reach its desired count again with the same task definition, without changing the application code and without reducing security.

Which action should the team take?

Choose one answer.

A. Increase the task's CPU and memory, since a resource initialization error usually means the task does not have enough capacity to start its containers.
B. Add the secretsmanager:GetSecretValue permission for the secret to the task execution role, which is the role ECS uses to start the task and retrieve the secret for the container.
C. Change the deployment type to a rolling update with a minimum healthy percent of zero, so that the service replaces all tasks at once with the new definition.
D. Delete the ECS service and create it again with the same task definition, so that the service's deployment state is reset before the next attempt.

Show the answer and explanation

Answer: B

A. Wrong: Resource initialization errors for secrets are not caused by capacity. More CPU and memory would not let the task read the secret.
B. Right: Correct. Fargate uses the task execution role to retrieve secrets for the container at startup, so that role must allow reading the secret. Adding that permission lets the new tasks start and the deployment finish. Learn more: Amazon ECS task execution IAM role (opens in a new tab)
C. Wrong: A zero minimum healthy percent does not fix the permission, and the new tasks would still fail to start. It would also remove the capacity the service needs during the deployment. Learn more: Deploy Amazon ECS services by replacing tasks (opens in a new tab)
D. Wrong: Recreating the service does not change the execution role, so the tasks would fail to start again. It also causes an outage while the service is rebuilt.

Explanation

A ResourceInitializationError for a secret on Fargate points to the task execution role, which ECS uses to fetch secrets at startup. Granting that role permission to read the secret lets the new tasks start, and the deployment finishes with the same task definition. Capacity changes, deployment settings and recreating the service do not change the permission.

DOP-C02 practice question: Troubleshooting failed deployments and stacks (2 of 3)

Explanation

Study

Keep practicing