Examkin

Question

Difficulty: HardAmazon ECS and Docker Deployment

A company's containerized microservice is being migrated to run on AWS Fargate. During task initialization, the Amazon ECS container agent must retrieve database credentials from AWS Secrets Manager and inject them as environment variables inside the container. The containerized application itself does not make any direct AWS SDK calls. A developer creates a task definition and specifies the Secrets Manager secret ARN in the `secrets` parameter of the container definition. However, when attempting to run the task, it fails to start, showing a `ResourceInitializationError` due to access denied errors while retrieving the secret.

Which configuration change is required to resolve this issue?

  1. Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.Answer
  2. B
    Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Role (`taskRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.
  3. C
    Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs.amazonaws.com` service principal to assume the role.
  4. D
    Remove the `secrets` parameter from the container definition, hardcode the database credentials in the application's SDK client configuration, and retrieve the secret directly from Secrets Manager at runtime.

Answer

Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.
The correct option correctly identifies that the ECS container agent retrieves the secret before container startup, meaning the permission must be on the Task Execution Role (`executionRoleArn`). It also correctly points out that the trust policy must allow the `ecs-tasks.amazonaws.com` service principal.

Step-by-Step Solution

1
Identify which role is responsible for secret retrieval during container startup.
The Amazon ECS container agent retrieves the secret and injects it as an environment variable before the application starts, which means this action is performed under the context of the Task Execution Role (`executionRoleArn`).
Permissions for operations performed by the ECS agent (such as pulling images or reading secrets for environment variables) belong to the Task Execution Role, while permissions for the application code itself belong to the Task Role.
2
Determine the required IAM permission and trust policy for the role.
The Task Execution Role must have `secretsmanager:GetSecretValue` permissions, and its trust policy must allow `ecs-tasks.amazonaws.com` to assume the role.
Without the correct trust policy, ECS cannot assume the role to fetch the secret, resulting in a task start failure.

Key Concept

ECS Task Role vs Task Execution Role for secret management
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic