Examkin

Question

Difficulty: HardAmazon ECS and Docker Deployment

A developer is deploying a containerized microservice to Amazon ECS using the AWS Fargate launch type. The application code inside the container must read messages from an Amazon SQS queue, decrypt the message payloads using an AWS KMS key, and write results to an Amazon DynamoDB table. Additionally, the task definition specifies that the database password, stored as a secure string in Systems Manager Parameter Store, should be injected as an environment variable at startup. The container image is pulled from a private Amazon ECR repository.

Which of the following configurations are required to establish the correct IAM permissions for this deployment? (Select TWO.)

  1. Configure the ECS Task Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the application code to read from the SQS queue, write to the DynamoDB table, and decrypt SQS payloads using the KMS key.Answer
  2. Configure the ECS Task Execution Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the container agent to pull from Amazon ECR, write to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store.Answer
  3. C
    Configure the ECS Task Execution Role with permissions to read from the SQS queue and write to the DynamoDB table, as the execution role handles all AWS API calls initiated by the containerized application.
  4. D
    Configure the ECS Task Role with permissions to retrieve the database password from Systems Manager Parameter Store, since the Task Role is used by the ECS container agent to inject sensitive environment variables at container startup.
  5. E
    Configure the ECS Task Execution Role with a trust policy that allows the fargate.amazonaws.com service principal to assume the role, as this is the specific launch type executing the tasks.

Answer

Configure the ECS Task Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the application code to read from the SQS queue, write to the DynamoDB table, and decrypt SQS payloads using the KMS key; and configure the ECS Task Execution Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the container agent to pull from Amazon ECR, write to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store.
To establish the correct IAM permissions, the ECS Task Role and the ECS Task Execution Role must be configured with the appropriate trust policies and permissions. The ECS Task Role is used by the application code running inside the container; therefore, it must be granted permissions to read from the SQS queue, write to the DynamoDB table, and decrypt the SQS payloads using the KMS key. The ECS Task Execution Role is used by the ECS container agent to perform actions on behalf of the task before the container starts; therefore, it must be granted permissions to pull the container image from the private Amazon ECR repository, write log streams to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store to inject it as an environment variable.

Step-by-Step Solution

1
Distinguish between infrastructure actions (ECS agent) and application actions (running code).
The application code reads from SQS, decrypts payloads, and writes to DynamoDB. The ECS agent pulls the Docker image, handles container logs, and pulls secrets to inject as environment variables at startup.
This separation determines whether a permission belongs to the Task Role or the Task Execution Role.
2
Assign the application permissions to the ECS Task Role and configure its trust policy.
Create an IAM role that trusts 'ecs-tasks.amazonaws.com' and attach a policy with permissions for SQS, DynamoDB, and KMS decryption.
The containerized application assumes this role at runtime to authenticate its AWS SDK client requests.
3
Assign the infrastructure/agent permissions to the ECS Task Execution Role and configure its trust policy.
Create an IAM role that trusts 'ecs-tasks.amazonaws.com' and attach a policy with permissions for ECR pulling, CloudWatch Logs writing, and Systems Manager Parameter Store reading.
The ECS container agent uses this role during container provisioning and startup phases.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role in AWS Fargate
Estimated Time:2m 30s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic