Examkin

Question

Difficulty: Very hardAmazon ECS and Docker Deployment

A company is deploying a secure microservice to Amazon ECS using the AWS Fargate launch type. The application code inside the container must pull messages from an Amazon SQS queue and write processed records to an Amazon DynamoDB table. Additionally, when the container is initialized, the Amazon ECS agent must retrieve database credentials from AWS Secrets Manager using the container definition secrets parameter and inject them as environment variables. The secret is encrypted using an AWS KMS customer managed key (CMK). During deployment, the tasks fail to transition to the RUNNING state, and the developer receives an error indicating that the container helper was unable to retrieve the Secrets Manager secret. How should the developer configure the IAM roles to resolve this issue and adhere to the principle of least privilege?

  1. Associate an IAM policy granting secretsmanager:GetSecretValue and kms:Decrypt permissions to the ECS Task Execution Role, and associate a separate IAM policy granting SQS and DynamoDB permissions to the ECS Task Role.Answer
  2. B
    Associate an IAM policy granting secretsmanager:GetSecretValue, kms:Decrypt, SQS, and DynamoDB permissions to the ECS Task Role, and leave the ECS Task Execution Role with the default AmazonECSTaskExecutionRolePolicy.
  3. C
    Associate an IAM policy granting secretsmanager:GetSecretValue and kms:Decrypt permissions to the ECS Task Execution Role, and update the trust policy of the ECS Task Execution Role to allow the service principal ecs.amazonaws.com to assume the role.
  4. D
    Associate an IAM policy granting secretsmanager:GetSecretValue and kms:Decrypt permissions to the ECS Task Execution Role, and configure the application code to initialize SDK clients by hardcoding temporary IAM user access keys.

Answer

The developer should associate an IAM policy with the ECS Task Execution Role that allows secretsmanager:GetSecretValue and kms:Decrypt, and associate another IAM policy with the ECS Task Role that allows Amazon SQS and DynamoDB access.
The correct option correctly separates the responsibilities of the two IAM roles. The ECS Task Execution Role is used by the ECS container agent to perform setup operations, such as pulling container images from ECR and retrieving secrets from Secrets Manager. Because the secret is encrypted with a KMS customer managed key, the execution role also requires kms:Decrypt permissions. The ECS Task Role is assumed by the application container itself at runtime to interact with AWS services like Amazon SQS and DynamoDB.

Step-by-Step Solution

1
Determine which role is responsible for retrieving secrets during container startup.
The ECS agent retrieves the secrets from Secrets Manager during the task startup phase, which requires permissions to be attached to the ECS Task Execution Role.
The Task Execution Role grants permissions to the ECS container agent, not the application itself.
2
Determine the required permissions for retrieving and decrypting the secret.
The ECS Task Execution Role must be granted secretsmanager:GetSecretValue and kms:Decrypt permissions because the secret is encrypted with a KMS customer managed key (CMK).
The ECS agent must be authorized to read the secret value and decrypt it using the specific key.
3
Determine which role is responsible for application-level AWS service access.
The application code runs inside the container and requires access to SQS and DynamoDB, which must be granted to the ECS Task Role.
The Task Role gives temporary credentials directly to the containerized application process.
4
Ensure the trust policy for both roles is correct.
Verify that both the Task Role and Task Execution Role have a trust relationship allowing the ecs-tasks.amazonaws.com service principal to assume the role.
If the trust relationship is set to ecs.amazonaws.com or another service, the tasks will fail to assume the roles during launch.

Key Concept

Understanding the separation of concerns between the ECS Task Role (application runtime permissions) and the ECS Task Execution Role (agent orchestration and startup permissions), and configuring necessary KMS decryption policies.
Estimated Time:3m 0s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic