Examkin

Question

Difficulty: Very hardIAM Policies and Roles

A developer is deploying a containerized application to Amazon ECS on AWS Fargate using the following task definition snippet:

{
"containerDefinitions": [
{
"name": "app-container",
"image": "111122223333.dkr.ecr.us-east-1.amazonaws.com/my-app:latest",
"logConfiguration": {
"logDriver": "awslogs",
"options": {
"awslogs-group": "/ecs/my-app",
"awslogs-region": "us-east-1",
"awslogs-stream-prefix": "ecs"
}
}
}
],
"taskRoleArn": "arn:aws:iam::111122223333:role/MyTaskRole",
"executionRoleArn": "arn:aws:iam::111122223333:role/MyExecutionRole"
}

The application code inside the container must read and delete messages from an Amazon SQS queue. The ECS agent must pull the private container image from Amazon ECR and send container logs to Amazon CloudWatch Logs.

Which of the following configurations must the developer perform to grant the necessary permissions? (Select TWO.)

  1. Attach an IAM policy containing `sqs:ReceiveMessage` and `sqs:DeleteMessage` permissions to the MyTaskRole role.Answer
  2. Attach an IAM policy containing `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, `ecr:GetAuthorizationToken`, and `logs:PutLogEvents` permissions to the MyExecutionRole role.Answer
  3. C
    Attach an IAM policy containing `sqs:ReceiveMessage` and `sqs:DeleteMessage` permissions to the MyExecutionRole role.
  4. D
    Attach an IAM policy containing `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, `ecr:GetAuthorizationToken`, and `logs:PutLogEvents` permissions to the MyTaskRole role.
  5. E
    Configure the trust relationship policy document of the MyExecutionRole role to allow the service principal `ecs.amazonaws.com` to perform the `sts:AssumeRole` action.

Answer

Attach SQS permissions to the task role (MyTaskRole) and attach ECR and CloudWatch Logs permissions to the task execution role (MyExecutionRole).
The configuration attaching SQS permissions to the task role is correct because the application code inside the container runs under the task role's context. The configuration attaching ECR and CloudWatch permissions to the task execution role is correct because the ECS agent needs these permissions to pull the image and send logs before/during the container runtime.

Step-by-Step Solution

1
Analyze the permission requirements of the application code running inside the container.
The application code reads and deletes SQS messages, which means it requires permissions for `sqs:ReceiveMessage` and `sqs:DeleteMessage` attached to the role that the application container assumes, which is the ECS Task Role (`taskRoleArn`).
The Task Role provides AWS credentials directly to the containerized application.
2
Analyze the permission requirements of the Amazon ECS container agent.
The ECS agent needs to authenticate with ECR, pull container images, and write logs to CloudWatch Logs. This requires `ecr:GetAuthorizationToken`, `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, and `logs:PutLogEvents` permissions attached to the ECS Task Execution Role (`executionRoleArn`).
The Task Execution Role provides AWS credentials to the ECS container agent to perform infrastructure/management tasks on behalf of the container.
3
Evaluate the correct service principal for the trust relationship of the roles.
Both the Task Role and Task Execution Role must trust the `ecs-tasks.amazonaws.com` service principal so that the ECS container agent can assume these roles.
Using `ecs.amazonaws.com` is incorrect as it is for the ECS service scheduler, not individual tasks.

Key Concept

Division of responsibility between ECS Task Role and ECS Task Execution Role
Rate this question

Topics

IAM Policies and Roles

More questions from this topic