Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is configuring an Amazon ECS task definition to run a microservice on AWS Fargate. The containerized application must retrieve database credentials stored as SecureString parameters in Systems Manager Parameter Store and inject them as environment variables during container startup. Additionally, the application code inside the container needs to read and write items in an Amazon DynamoDB table at runtime. Which configuration of IAM roles should the developer specify in the task definition to satisfy these requirements?

  1. A
    Specify a Task Execution Role containing permissions to retrieve the Parameter Store parameters, and a Task Role containing permissions to access the DynamoDB table, but configure the trust policy of the Task Role to trust the DynamoDB service.
  2. Specify a Task Execution Role containing permissions to retrieve the Parameter Store parameters, and a Task Role containing permissions to access the DynamoDB table.Answer
  3. C
    Specify a Task Role containing permissions to both retrieve the Parameter Store parameters and access the DynamoDB table, leaving the Task Execution Role empty.
  4. D
    Specify a Task Execution Role containing permissions to both retrieve the Parameter Store parameters and access the DynamoDB table, leaving the Task Role empty.

Answer

Specify a Task Execution Role containing permissions to retrieve the Parameter Store parameters, and a Task Role containing permissions to access the DynamoDB table.
The correct answer properly separates the concerns of task bootstrapping and container runtime execution. The Task Execution Role is utilized by the Amazon ECS container agent to pull secrets from Systems Manager Parameter Store and inject them into the container's environment variables before startup. The Task Role is assumed by the application code running inside the container to make AWS SDK calls to Amazon DynamoDB at runtime. Both roles must trust the ECS tasks service principal to be assumed correctly.

Step-by-Step Solution

1
Identify the agent-level requirements during container bootstrap.
The ECS agent needs to fetch SSM Parameter Store secure parameters to inject them as environment variables before the container starts, which requires the ECS Task Execution Role.
The Task Execution Role grants the ECS container agent permissions to make AWS API calls on your behalf (such as pulling container images and pulling secrets).
2
Identify the application-level requirements at runtime.
The application code running inside the container needs to read/write to the DynamoDB table, which requires the ECS Task Role.
The Task Role grants the containerized application itself permissions to call AWS APIs at runtime.
3
Verify trust policy configurations.
Both roles must have a trust policy allowing the ecs-tasks.amazonaws.com service principal to assume the role.
Trust policies determine which entities (in this case, ECS tasks) are permitted to assume the IAM roles.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role
Estimated Time:1m 30s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic