ExamFinch.com My Study

Study guide

8.3 Deployment Strategies & Container Deployments

Practice this exam

AWS Certified CloudOps Engineer – Associate SOA-C03

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Monitoring & Observability Infrastructure

1.1 Configuring Workload Observability 1.2 CloudWatch Agent Architecture & Deployment 1.3 Metric Alarms, Anomaly Detection & Composite Alarms

2 Chapter 2: Alarms, Dashboards & Event-Driven Remediation

2.1 CloudWatch Dashboards & Multi-Account Visibility 2.2 Notification Architecture & Alarm Invocation 2.3 Amazon EventBridge Rules, Event Buses & Troubleshooting 2.4 Automated Remediation with Systems Manager & Lambda

3 Chapter 3: Performance Optimization for Compute, Storage & Databases

3.1 EC2 & Compute Performance Optimization 3.2 Amazon EBS Performance Metrics & Volume Tuning 3.3 S3 Performance Strategies & Data Transfer 3.4 Shared Storage (EFS/FSx) & Database Performance

4 Chapter 4: Compute & Database Scalability and Elasticity

4.1 EC2 Auto Scaling Policies & Elasticity 4.2 Auto Scaling Advanced Operations: Warm Pools & Lifecycle Hooks 4.3 Dynamic Scalability Through Caching 4.4 Managed Database Scaling: RDS, Aurora & DynamoDB

5 Chapter 5: High Availability, Fault Tolerance & Load Balancing

5.1 Elastic Load Balancing (ALB/NLB) Configuration & Troubleshooting 5.2 Route 53 Health Checks & DNS Failover 5.3 Multi-AZ Architecture & Fault-Tolerant Deployments

6 Chapter 6: Backup, Data Protection & Disaster Recovery

6.1 Centralized Backup Automation & AWS Backup 6.2 Database Restore Strategies & RTO/RPO Management 6.3 Storage Versioning, Replication & Immutability 6.4 Disaster Recovery Patterns & Multi-Region Resilience

7 Chapter 7: Infrastructure as Code with CloudFormation & AWS CDK

7.1 CloudFormation Foundations & Resource Modeling 7.2 Managing Stacks, Drift Detection & Change Sets 7.3 Infrastructure as Code with AWS CDK 7.4 Identifying & Remediating Deployment Failures

8 Chapter 8: Multi-Account Provisioning, Containers & Third-Party IaC

8.1 Golden Images with EC2 Image Builder & Amazon ECR 8.2 Multi-Account & Multi-Region Resource Sharing 8.3 Deployment Strategies & Container Deployments 8.4 Third-Party Automation with Terraform & Git Workflows

9 Chapter 9: Systems Manager & Event-Driven Operations Automation

9.1 AWS Systems Manager Core Management & Run Command 9.2 Systems Manager Patch Manager & Session Manager 9.3 Event-Driven Operations Automation

10 Chapter 10: Identity, Access Management & Governance

10.1 Advanced IAM Policies, Roles & Policy Conditions 10.2 Auditing Access with CloudTrail Lake & IAM Access Analyzer 10.3 Multi-Account Security: Organizations, SCPs & Identity Center 10.4 Compliance Enforcement with AWS Config & Conformance Packs

11 Chapter 11: Data Security, Encryption & Vulnerability Management

11.1 Data Classification & Amazon S3 Security 11.2 Encryption at Rest with AWS Key Management Service (KMS) 11.3 Encryption in Transit with AWS Certificate Manager (ACM) 11.4 Secrets Management & Centralized Security Findings

12 Chapter 12: VPC Architecture, Endpoints & Network Protection

12.1 VPC Core Architecture, Subnetting & High Availability NAT 12.2 Private Network Connectivity: VPC Endpoints & Peering 12.3 Network Protection & Edge Security Auditing

13 Chapter 13: DNS, Route 53 Routing & Content Delivery

13.1 DNS Architecture & Route 53 Resolver for Hybrid Clouds 13.2 Route 53 Advanced Routing Policies & Query Logging 13.3 Global Content & Service Distribution: CloudFront & Global Accelerator

14 Chapter 14: Network Troubleshooting, Traffic Analysis & Hybrid Connectivity

14.1 VPC Configuration Troubleshooting & Analysis Tools 14.2 Network Traffic Analysis: VPC Flow Logs & Log Analytics 14.3 CloudFront Caching & Hybrid Connectivity Troubleshooting

8.3 Deployment Strategies & Container Deployments

Key Takeaways Explain This Topic AI

In-place and rolling updates modify existing fleets, blue/green deployments switch traffic between isolated environments for instant rollback, and canary or linear deployment configurations shift traffic incrementally to validate workload health.

AWS CodeDeploy automates application deployments across EC2, ECS, and Lambda using deployment groups, predefined deployment configurations, and declarative lifecycle hook events defined in appspec.yml.

CodeDeploy EC2 lifecycle hooks execute in a strict sequential lifecycle: ApplicationStop, DownloadBundle, BeforeInstall, Install, AfterInstall, ApplicationStart, and ValidateService.

Amazon ECS rolling updates control task scaling boundaries using minimumHealthyPercent (e.g., 100%) and maximumPercent (e.g., 200%), ensuring required operational capacity is maintained while new tasks launch.

The ECS Deployment Circuit Breaker automatically detects failing task launches and container health check failures, halts deployment immediately, and triggers automated rollbacks to the last stable task definition without manual intervention.

Last updated: September 2026

8.3 Deployment Strategies & Container Deployments

CloudOps Blueprint Focus: Delivering continuous application updates without customer downtime or capacity degradation is a vital operational competency on the AWS Certified CloudOps Engineer – Associate (SOA-C03) exam. You must master the architectural trade-offs of in-place, rolling, blue/green, canary, and linear deployments, configure AWS CodeDeploy lifecycle hooks and deployment configurations, govern Amazon ECS rolling update capacity bounds, and enable automated rollbacks using the ECS Deployment Circuit Breaker.

Comparative Architecture of Deployment Strategies

Choosing a deployment strategy balances downtime, costs, release velocity, and rollback complexity:

Deployment Pattern Extra Capacity Cost Downtime Risk Rollback Mechanism & Speed Target Services

In-Place Zero (no extra instances). Moderate to High (instances stop during update). Slow. Requires redeploying previous software version. Standalone EC2 instances, batch compute.

Rolling Low (minimal temporary buffer). Low (capacity preserved if minimum healthy host threshold set). Moderate. Rolls backward across instance batches. EC2 Auto Scaling groups, Amazon ECS.

Blue/Green High (requires 100% duplicate capacity during cutover). Zero Downtime. Traffic shifted at load balancer or DNS. Instantaneous. Reverse target group routing or DNS pointer. Amazon ECS, Elastic Beanstalk, EC2 ALB.

Canary Moderate (provisions small canary capacity or routes fraction). Near-Zero. Validates health against small user slice (e.g., 10%). Rapid. Reverts canary routing immediately upon alarm. AWS Lambda, Amazon ECS, API Gateway.

Linear Moderate (scales traffic in equal stepped increments). Near-Zero. Gradually expands exposure (e.g., 10% every 5 min). Rapid. Aborts traffic shift if alarms trigger at any step. CodeDeploy for ECS and Lambda.

AWS CodeDeploy Architecture & AppSpec Lifecycle Hooks

AWS CodeDeploy automates application deployments across Amazon EC2, on-premises instances, Amazon ECS, and AWS Lambda.

A CodeDeploy deployment comprises:

Application & Deployment Group: Identifies the software and defines target instances (filtered by EC2 tags or Auto Scaling group), ECS services, or Lambda functions, alongside deployment style and rollback alarms.

Deployment Configuration: Dictates rollout pace and host health thresholds.

AppSpec File ( appspec.yml ): Declarative configuration file specifying file mappings, permissions, and lifecycle hook execution scripts.

CodeDeploy EC2 Lifecycle Hook Execution Order

On Amazon EC2 and on-premises instances, the host-installed CodeDeploy Agent executes lifecycle hook scripts in strict sequential order:

ApplicationStop: Stops running application daemons or drains connections.

DownloadBundle: Reserved phase where agent extracts revision archives from S3 or GitHub.

BeforeInstall: Executes pre-installation tasks (e.g., backing up files, decrypting secrets).

Install: Reserved phase where agent copies files to destination directories.

AfterInstall: Executes post-installation tasks (e.g., database configs, permissions).

ApplicationStart: Starts the updated application daemon or service.

ValidateService: Runs verification scripts (e.g., querying /health endpoints). Non-zero exit code halts deployment on that host. version: 0.0

os: linux

files:

  • source: /
  • destination: /var/www/app

hooks:

AfterInstall:

  • location: scripts/configure.sh
  • timeout: 120

ApplicationStart:

  • location: scripts/start.sh
  • timeout: 60

ValidateService:

  • location: scripts/health_check.sh
  • timeout: 30
  • CodeDeploy Deployment Configurations

For EC2 and Auto Scaling groups, CodeDeploy enforces minimum healthy host thresholds:

CodeDeployDefault.OneAtATime : Updates instances one by one, providing lowest capacity risk.

CodeDeployDefault.HalfAtATime : Updates up to 50% of the fleet simultaneously, retaining 50% capacity.

CodeDeployDefault.AllAtOnce : Updates all instances simultaneously, incurring maximum downtime risk.

Custom Configurations: Defines MinimumHealthyHosts as a count ( FLEET_COUNT ) or percentage ( FLEET_PERCENT ), e.g., enforcing 75% fleet availability.

Amazon ECS Rolling Updates & Capacity Boundaries

When deploying container updates to Amazon ECS services without CodeDeploy blue/green routing, ECS performs native Rolling Updates governed by two capacity boundaries:

Minimum Healthy Percent ( minimumHealthyPercent ): The lower bound of active tasks that must remain in RUNNING state (and pass ALB health checks) during deployment, expressed as a percentage of desiredCount .

Maximum Percent ( maximumPercent ): The upper bound of total running tasks (old plus new) permitted during deployment, expressed as a percentage of desiredCount .

Calculating Capacity Boundaries

Desired: 4, Min: 100%, Max: 200%: Launches 4 new tasks first (total 8). Once healthy, terminates 4 old tasks. Zero downtime, requires 2x compute capacity.

Desired: 4, Min: 50%, Max: 100%: Terminates 2 old tasks first to free capacity (total drops to 2), then launches 2 new tasks. Incurs temporary 50% capacity reduction.

Desired: 6, Min: 100%, Max: 150%: Launches 3 new tasks (total 9). Once healthy, terminates 3 old tasks, then provisions final 3. Preserves 100% capacity within account vCPU quotas.

Desired: 1, Min: 0%, Max: 100%: Terminates the lone task before launching its replacement. Incurs brief downtime.

ECS Deployment Circuit Breaker & Automated Rollback

If a new container image crashes on startup or fails container health checks, ECS repeatedly attempts task launches. Without guardrails, this creates an infinite crash-loop where the deployment stalls indefinitely.

The Amazon ECS Deployment Circuit Breaker resolves this failure pattern:

Automated Failure Detection: Monitors task launches during rolling updates. If tasks repeatedly fail to enter RUNNING or fail health checks, the deployment is marked as FAILED .

Automated Rollback: When configured with rollback: true , the circuit breaker immediately reverts the service to the last stable task definition without manual operator intervention.

Amazon ECS Capacity Providers: EC2 & AWS Fargate

An ECS Capacity Provider abstracts compute infrastructure management from container task scheduling:

AWS Fargate Capacity Providers: Uses FARGATE and FARGATE_SPOT strategies with base allocations and weight ratios to balance cost against interruption resilience.

EC2 Auto Scaling Capacity Providers: Pairs ECS clusters with Auto Scaling groups, using Managed Scaling ( CapacityProviderReservation ) and Managed Termination Protection to right-size EC2 capacity without terminating instances hosting running tasks.