Examkin

Question

Difficulty: EasyAmazon ECS and Docker Deployment

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The ECS task needs to pull the container image from a private Amazon ECR repository and send container logs to Amazon CloudWatch. Once running, the application code inside the container must read data files from an Amazon S3 bucket.

Which two IAM configuration steps must the developer take in the ECS task definition to grant these permissions?

  1. Configure the Task Execution Role with permissions to pull the container image from Amazon ECR and send logs to Amazon CloudWatch.Answer
  2. Configure the Task Role with permissions to read objects from the Amazon S3 bucket.Answer
  3. C
    Configure the Task Role with permissions to pull the container image from Amazon ECR.
  4. D
    Configure the Task Execution Role with permissions to read objects from the Amazon S3 bucket.
  5. E
    Hardcode IAM user credentials with Amazon S3 read permissions in the application's environment variables.

Answer

Configure the Task Execution Role with permissions to pull the container image from Amazon ECR and send logs to Amazon CloudWatch, and configure the Task Role with permissions to read objects from the Amazon S3 bucket.
To deploy the application securely, the developer must use two separate IAM roles. The Task Execution Role is required by the Amazon ECS container agent to authenticate with Amazon ECR to pull the Docker image and to create log streams in Amazon CloudWatch before the container starts. The Task Role is assumed by the application code running inside the container to authorize calls to other AWS services, such as reading files from the Amazon S3 bucket.

Step-by-Step Solution

1
Identify the permissions needed by the ECS agent / container runtime vs the application code.
ECR image pulling and CloudWatch log streaming are performed by the ECS agent, while S3 reading is performed by the application code.
This separation determines which IAM roles need to be configured in the task definition.
2
Assign the ECS agent permissions to the Task Execution Role.
The Task Execution Role receives permissions for ECR and CloudWatch.
The Task Execution Role is used by the infrastructure to set up the task before application code runs.
3
Assign the application permissions to the Task Role.
The Task Role receives permissions for S3 bucket access.
The Task Role is assumed by the containerized application at runtime to make AWS SDK calls.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic