Skill 3.3.8: Implement automated agent deployment pipelines and agent version management
| Question | Answer & Explanation |
|---|---|
| ### Question 1 - Amazon Bedrock Agent Alias Traffic Shifting A financial services company has deployed an enterprise customer support agent using Amazon Bedrock Agents. The engineering team has prepared a new version of the agent (Version 3) that includes updated action groups for processing loan applications. Before fully releasing the new functionality, the team wants to route 10% of the production traffic to Version 3 while keeping the remaining 90% on the stable Version 2. The solution must minimize operational overhead and require no changes to the client application code. Which configuration meets these requirements? (Select ONE) - A) Deploy two separate Bedrock agents and use an Application Load Balancer to distribute traffic between them. - B) Create an alias for the Bedrock agent and configure it to route 10% of traffic to Version 3 and 90% to Version 2. - C) Update the client application logic to dynamically switch between Version 2 and Version 3 ARNs based on a random hash. - D) Use AWS CodeDeploy to perform a canary deployment of the Bedrock agent endpoint. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon Bedrock Agents support aliases, which act as stable endpoints for your application to invoke. An alias can be configured to route a specific percentage of traffic to different versions of the agent. This allows for native canary testing or blue/green deployments directly within Bedrock, without requiring application code changes or external traffic routing infrastructure. Distractor Analysis: - A is Incorrect: Deploying two separate Bedrock agents and introducing an Application Load Balancer adds unnecessary operational overhead and architectural complexity. Bedrock aliases handle this natively. - C is Incorrect: Modifying the client application to handle routing logic violates the requirement of no application code changes and increases development overhead. - D is Incorrect: AWS CodeDeploy is used for deploying code to compute services like EC2, ECS, and Lambda. It does not manage traffic routing for Amazon Bedrock Agents. > Key Takeaway: Amazon Bedrock Agent aliases provide a stable endpoint for client applications and support weighted routing across different agent versions for seamless canary and blue/green deployments. |
| ### Question 2 - CI/CD Pipeline for Bedrock Agent Infrastructure An AI engineering team is managing the lifecycle of an Amazon Bedrock Agent using Infrastructure as Code (IaC). The agent’s definition, instruction prompts, and OpenAPI schemas for action groups are stored in an AWS CodeCommit repository. The team needs to automatically deploy updates to a staging environment whenever changes are merged into the main branch. The deployment must strictly follow the least operational overhead principle. Which AWS services should the team use to build this automated deployment pipeline? (Select ONE) - A) AWS CodePipeline to orchestrate the workflow and AWS CodeBuild to run AWS CloudFormation commands that update the Bedrock Agent. - B) AWS Step Functions to orchestrate the workflow and AWS Lambda functions to execute the Bedrock API SDK calls. - C) Amazon EventBridge to detect commits and AWS CloudFormation directly to deploy the agent. - D) AWS CodePipeline to orchestrate the workflow and Amazon ECS to run containerized API calls to Bedrock. |
Correct Answer: A Correct Answer Analysis: - A is Correct: AWS CodePipeline natively integrates with AWS CodeCommit to trigger on repository changes. AWS CodeBuild can execute the deployment commands (like AWS CLI or CloudFormation updates) to interact with the Amazon Bedrock API and apply the IaC changes. This is the standard, lowest-overhead approach for AWS CI/CD pipelines. Distractor Analysis: - B is Incorrect: Using AWS Step Functions and custom AWS Lambda functions to orchestrate API SDK calls introduces custom code and unnecessary operational overhead compared to native CI/CD services. - C is Incorrect: While Amazon EventBridge can detect CodeCommit commits, it cannot directly invoke AWS CloudFormation to deploy resources; it requires an intermediary target like a Lambda function or a CodePipeline. - D is Incorrect: Running containerized API calls in Amazon ECS for a CI/CD pipeline deployment step is highly inefficient and introduces significant maintenance overhead compared to serverless CodeBuild. > Key Takeaway: For MLOps and AI workloads, AWS CodePipeline and AWS CodeBuild provide the native, serverless foundation for automating infrastructure deployments defined in CloudFormation or CDK. |
| ### Question 3 - Automated Rollback for Bedrock Agents A production Amazon Bedrock Agent was recently updated to Version 6, introducing a new Lambda-backed action group. However, users are reporting that the new action group is failing to execute properly, causing severe disruptions. The team needs to immediately restore service by routing all traffic back to the previously stable Version 5. The rollback mechanism must be executed with the least operational overhead and without modifying the client application. Which action will successfully perform the rollback? (Select ONE) - A) Repoint the production alias from Version 6 to Version 5. - B) Delete Version 6 from the Amazon Bedrock console so traffic defaults to Version 5. - C) Update the client application configuration to use the ARN of Version 5. - D) Trigger a new CodePipeline execution that redeploys the Version 5 CloudFormation template. |
Correct Answer: A Correct Answer Analysis: - A is Correct: Amazon Bedrock Agent versions are immutable once created. By using an alias, the team simply updates the alias routing to send 100% of traffic back to Version 5. This is an instantaneous API call that requires no infrastructure provisioning or client-side changes. Distractor Analysis: - B is Incorrect: You cannot delete an agent version that is currently associated with an alias, and deleting a version does not automatically "fall back" traffic to a previous version. - C is Incorrect: Modifying the client application configuration violates the constraint of not modifying the client application and introduces higher operational overhead and risk. - D is Incorrect: Re-running a CodePipeline deployment of a CloudFormation template takes longer to execute and is not an immediate rollback mechanism compared to simply repointing an alias. > Key Takeaway: Agent aliases are the primary mechanism for instantaneous rollbacks in Amazon Bedrock, allowing traffic to be shifted back to a previous immutable version without code changes. |
| ### Question 4 - Event-Driven Agent Pipeline Testing A retail company uses an Amazon Bedrock Agent to answer product inquiries by querying an Amazon OpenSearch Serverless index. The index is updated daily via an automated ingestion job. The engineering team wants to ensure that the agent correctly queries the new product data. They require a fully automated, event-driven pipeline that triggers integration tests against the agent immediately after the OpenSearch index ingestion job completes successfully. The solution must minimize operational overhead. Which architecture fulfills this requirement? (Select ONE) - A) Configure an Amazon CloudWatch alarm on OpenSearch errors to trigger an AWS Lambda function that tests the agent. - B) Use an Amazon EventBridge rule to capture the successful OpenSearch ingestion job completion and trigger an AWS CodePipeline execution for testing. - C) Set up a daily cron job in AWS CodeBuild to run the integration tests an hour after the ingestion job typically completes. - D) Use AWS Step Functions to poll the OpenSearch Serverless API for job completion before executing the tests. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Amazon EventBridge can listen for specific state change events from AWS services (like a successful Bedrock Knowledge Base ingestion or OpenSearch batch job). Routing this event to AWS CodePipeline natively triggers the testing stage without manual polling or delays, fulfilling the event-driven requirement with native integrations. Distractor Analysis: - A is Incorrect: A CloudWatch alarm on errors triggers a response to failures, not a successful completion. This does not fulfill the requirement of testing after a successful ingestion job. - C is Incorrect: A cron job relies on time estimation ("an hour after") rather than being truly event-driven, which can lead to false test failures if the ingestion job runs late, or wasted time if it finishes early. - D is Incorrect: Using AWS Step Functions to poll an API for job completion introduces unnecessary custom orchestration and operational overhead compared to an event-driven EventBridge rule. > Key Takeaway: Amazon EventBridge is the recommended service for creating event-driven CI/CD triggers in AWS, allowing pipelines to execute immediately in response to state changes in dependent resources. |
| ### Question 5 - Action Group Testing in CI/CD As part of an automated CI/CD pipeline for an Amazon Bedrock Agent, an engineering team needs to validate that a newly deployed agent version correctly parses user intent and invokes the appropriate Lambda function via its action group. The test must be automated and run within the build stage of the pipeline. The constraint is that the solution must not impact the production alias. Which approach should the team implement in AWS CodeBuild? (Select ONE) - A) Write a Python script in CodeBuild that uses the Bedrock Runtime API to invoke the newly created agent version directly (not the alias) and asserts that the correct action group trace is returned. - B) Deploy the agent to production and use Amazon CloudWatch to monitor the Invocation5XXErrors metric for 10 minutes.- C) Manually invoke the agent in the AWS Management Console using the test workbench during the build stage. - D) Use AWS CodeDeploy to shift 10% of traffic to the new agent version and observe user feedback. |
Correct Answer: A Correct Answer Analysis: - A is Correct: AWS CodeBuild can execute custom test scripts. By targeting the specific immutable Version ID (e.g., agentId:version) rather than the production alias, the script can validate the agent's behavior, including checking the trace response for the invoked action group, without affecting production traffic.Distractor Analysis: - B is Incorrect: Deploying to production before testing violates CI/CD best practices. The goal is to gate the deployment using tests in the build stage, not to monitor production after the fact. - C is Incorrect: Manual testing in the console during a build stage is not automated and cannot be integrated into a CI/CD pipeline. - D is Incorrect: Using AWS CodeDeploy to shift traffic is a deployment strategy, not a build-stage testing strategy. Furthermore, it exposes users to an untested agent version. > Key Takeaway: In MLOps pipelines for Generative AI, automated behavioral testing in CodeBuild (e.g., asserting correct action group invocation via the agent trace) is essential for gating deployments before any traffic is shifted. |
| ### Question 6 - Agent Configuration Version Control An organization is deploying an Amazon Bedrock Agent across multiple AWS accounts (Development, Staging, and Production). The team needs to ensure that the agent's instructions, prompt variables, and OpenAPI schema are strictly version-controlled, auditable, and deployed consistently across all environments. The solution must minimize manual intervention. Which methodology should the team adopt? (Select ONE) - A) Manually export the agent configuration from the Development account and import it into the Staging and Production accounts using the AWS CLI. - B) Store the agent configuration as AWS CloudFormation templates in an AWS CodeCommit repository and use AWS CodePipeline to deploy them across accounts. - C) Use Amazon SageMaker Model Registry to store the agent's OpenAPI schema and deploy it via a SageMaker Pipeline. - D) Hardcode the agent instructions in the application's backend code and deploy the application using AWS Elastic Beanstalk. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Storing configurations as AWS CloudFormation templates in a Git repository (AWS CodeCommit) and deploying via AWS CodePipeline ensures Infrastructure as Code (IaC). This provides strict version control, auditability through commit history, and consistent, automated deployments across multiple AWS accounts. Distractor Analysis: - A is Incorrect: Manual export/import processes are prone to human error, lack auditability, and do not meet the requirement of minimizing manual intervention. - C is Incorrect: Amazon SageMaker Model Registry is designed for tracking traditional ML model artifacts and weights, not for deploying Amazon Bedrock Agent configurations and OpenAPI schemas. - D is Incorrect: Hardcoding agent instructions in the application code tightly couples the agent definition to the application, preventing independent versioning and agile updates to the agent without redeploying the entire application. > Key Takeaway: Treating AI agent configurations (prompts, schemas, action groups) as Infrastructure as Code using CloudFormation and CodePipeline ensures repeatability and auditability across environments. |
| ### Question 7 - Bedrock Agent Aliases for Blue/Green Deployments An enterprise is updating the underlying foundation model of their Amazon Bedrock Agent from Anthropic Claude 2 to Claude 3. The team wants to perform a blue/green deployment. They need to maintain the ability to instantly roll back to the previous model if the new model behaves unexpectedly. The rollback must not require any client-side code changes. How should the team manage the deployment using Bedrock native features? (Select ONE) - A) Create a new Bedrock Agent for the Claude 3 configuration. Update the application's DNS records to point to the new agent's ARN. - B) Create a new version of the existing Bedrock Agent with the Claude 3 foundation model. Update the existing production alias to route 100% of traffic to the new version. - C) Update the existing Bedrock Agent in place to use Claude 3, keeping a backup of the old instructions. - D) Deploy the Claude 3 agent as a new version. Use an AWS Lambda function as a proxy to route traffic between the two agent versions. |
Correct Answer: B Correct Answer Analysis: - B is Correct: Bedrock Agents support immutable versions. By creating a new version with the Claude 3 configuration and shifting the production alias to this new version, the application continues to invoke the alias ARN. If a rollback is needed, the alias can simply be repointed back to the previous version, satisfying all constraints. Distractor Analysis: - A is Incorrect: Creating a new agent and changing DNS records requires infrastructure changes outside of Bedrock and complicates rollback procedures. The application would need to be updated to point to the new ARN if not using a custom domain, violating constraints. - C is Incorrect: Updating the agent "in place" is not possible in Bedrock; updates create a draft that must be prepared as a new version. Furthermore, this destroys the easy rollback path. - D is Incorrect: Introducing a Lambda proxy adds unnecessary operational overhead and custom code, whereas Bedrock aliases natively handle traffic routing and rollback. > Key Takeaway: Amazon Bedrock's version and alias system is purpose-built for blue/green deployments, allowing foundation model updates to be rolled out and instantly rolled back without modifying client application endpoints. |
| ### Question 8 - CI/CD for Action Group Schemas A developer updates the OpenAPI schema for an Amazon Bedrock Agent's action group in an AWS CodeCommit repository to include a new required parameter. The engineering team wants to automate the deployment of this updated schema to the Bedrock Agent in the staging environment. The pipeline should only update the action group schema and not create a new agent version until validation is complete. Which command should the AWS CodeBuild stage execute to fulfill this requirement? (Select ONE) - A) aws bedrock update-agent-action-group- B) aws bedrock create-agent-version- C) aws bedrock update-agent- D) aws bedrock invoke-agent |
Correct Answer: A Correct Answer Analysis: - A is Correct: The update-agent-action-group API (and CLI command) is used to modify the configuration of an existing action group, including updating the OpenAPI schema stored in Amazon S3. This updates the working draft of the agent without immediately creating a new immutable version, allowing for validation before versioning.Distractor Analysis: - B is Incorrect: create-agent-version freezes the current draft state into an immutable version. The team should only do this after the schema is updated and validated.- C is Incorrect: update-agent is used to update the agent's foundational configuration (like the instruction prompt or foundation model), not specifically the action group's OpenAPI schema.- D is Incorrect: invoke-agent is the runtime command used by client applications to generate responses, not an administrative command for updating agent configurations in a CI/CD pipeline.> Key Takeaway: The update-agent-action-group command allows pipelines to incrementally update action group schemas within the Draft environment before committing the changes via create-agent-version. |
| ### Question 9 - Agent IAM Roles in CI/CD As part of an automated deployment pipeline for an Amazon Bedrock Agent, the agent needs permissions to query an Amazon Aurora PostgreSQL database via an action group backed by a Lambda function. The pipeline must ensure the IAM execution role attached to the agent follows the principle of least privilege. The pipeline runs in a centralized deployment account and deploys the agent to a target workload account. Which IAM configuration approach is the most secure and aligns with AWS best practices? (Select ONE) - A) Attach the AdministratorAccess managed policy to the agent's service role to ensure it never lacks permissions.- B) Create a scoped IAM role in the target account with a trust policy allowing the Bedrock service, granting permissions only to invoke the specific Lambda function. Use AWS CloudFormation StackSets to deploy this role. - C) Hardcode the database credentials in the OpenAPI schema and attach a policy granting full RDS access to the agent. - D) Use the same IAM role that the AWS CodePipeline service uses to deploy the agent, passing it as the agentResourceRoleArn. |
Correct Answer: B Correct Answer Analysis: - B is Correct: The Bedrock Agent requires a service role to invoke other AWS services (like Lambda). Creating a scoped role in the target workload account with a trust policy for bedrock.amazonaws.com and permissions restricted only to invoking the specific action group Lambda is the definition of least privilege. Using CloudFormation StackSets allows automated, cross-account deployment of this role.Distractor Analysis: - A is Incorrect: Attaching AdministratorAccess violates the principle of least privilege and poses a massive security risk.- C is Incorrect: Hardcoding database credentials in an OpenAPI schema is a severe security anti-pattern. Furthermore, the agent interacts with the Lambda function, not the database directly, so it does not need RDS permissions. - D is Incorrect: The CodePipeline service role has permissions to deploy infrastructure (CloudFormation, IAM, etc.), which are overly broad and inappropriate for a runtime agent executing queries against a database. > Key Takeaway: When deploying Bedrock Agents via CI/CD, use CloudFormation StackSets to provision dedicated, least-privilege IAM service roles in the target accounts, trusting only the Bedrock service principal. |
| ### Question 10 - Auditability of Agent and Model Versions A pharmaceutical company is deploying an Amazon Bedrock Agent that uses a fine-tuned foundation model hosted in Amazon SageMaker. Due to strict regulatory compliance requirements, the company must be able to produce an audit report showing the exact combination of the Bedrock Agent version and the SageMaker model version that was serving production traffic at any given time in the past. The solution must minimize manual tracking. Which combination of AWS services provides this traceability? (Select TWO) - A) Store the agent's CloudFormation templates and SageMaker model ARNs in AWS CodeCommit. - B) Use Amazon Bedrock Prompt Management to version the agent's instructions. - C) Register the fine-tuned model in the Amazon SageMaker Model Registry to track its version and lineage. - D) Use AWS CloudTrail to log all InvokeAgent API calls.- E) Monitor the agent's latency using Amazon CloudWatch. |
Correct Answers: A and C Correct Answer Analysis: - A is Correct: Storing the agent configurations (including references to the specific SageMaker model ARN being used) in AWS CodeCommit ensures that the state of the agent version is captured in Git history, providing an immutable audit trail of what was deployed and when. - C is Correct: SageMaker Model Registry tracks model versions, their approval status, and lineage. By registering the fine-tuned model here, the team has a versioned repository of the model itself. Combining the CodeCommit history (showing which model ARN was referenced in Agent Version X) and the SageMaker Model Registry (showing what that ARN corresponds to) provides end-to-end traceability. Distractor Analysis: - B is Incorrect: While Bedrock Prompt Management versions prompts, it does not provide a holistic audit trail for the entire agent configuration or the external SageMaker model versions linked to it. - D is Incorrect: AWS CloudTrail logs API calls (like who invoked the agent and when), but it does not natively map the invocation to the specific versioned combination of the agent and the SageMaker model for audit purposes. - E is Incorrect: Amazon CloudWatch monitors operational metrics like latency and errors, which is useful for performance monitoring but does not fulfill regulatory requirements for version traceability. > Key Takeaway: For strict auditability in AI deployments, combine SageMaker Model Registry (for model version tracking) with CodeCommit history (for agent configuration and ARN referencing) to establish a clear lineage of what served production traffic. |