Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is preparing to deploy a containerized backend application to Amazon ECS using the AWS Fargate launch type. The application must process incoming requests and write transaction records directly to an Amazon DynamoDB table. The container image is stored in a private Amazon Elastic Container Registry (Amazon ECR) repository. Additionally, the task definition is configured to use the awslogs log driver to stream container logs to Amazon CloudWatch Logs. Which configuration steps must the developer perform to ensure that the task has the minimum required permissions to initialize and run successfully? (Select TWO.)

  1. Configure an IAM role (Task Role) that grants permissions for dynamodb:PutItem and dynamodb:UpdateItem, specify ecs-tasks.amazonaws.com as the trusted entity in its trust policy, and assign it to the taskRoleArn parameter in the task definition.Answer
  2. Configure an IAM role (Task Execution Role) that grants permissions for ecr:BatchGetImage, ecr:GetDownloadUrlForLayer, logs:CreateLogStream, and logs:PutLogEvents, specify ecs-tasks.amazonaws.com as the trusted entity in its trust policy, and assign it to the executionRoleArn parameter in the task definition.Answer
  3. C
    Configure an IAM role with permissions for dynamodb:PutItem and assign it to the executionRoleArn parameter in the task definition.
  4. D
    Configure an IAM role with permissions for ecr:BatchGetImage and logs:CreateLogStream and assign it to the taskRoleArn parameter in the task definition.
  5. E
    Modify the trust policy of both the Task Role and Task Execution Role to allow the Amazon EC2 service principal (ec2.amazonaws.com) to assume the roles.

Answer

The developer must configure a Task Role with DynamoDB permissions and assign it to taskRoleArn, and configure a Task Execution Role with ECR and CloudWatch Logs permissions and assign it to executionRoleArn.
The correct options properly separate application-level permissions (assigned to the Task Role via taskRoleArn) from infrastructure/agent-level permissions (assigned to the Task Execution Role via executionRoleArn). Under the Fargate launch type, both roles must trust the ecs-tasks.amazonaws.com service principal.

Step-by-Step Solution

1
Determine application code requirements.
The application code running inside the container needs to write to Amazon DynamoDB, requiring dynamodb:PutItem and dynamodb:UpdateItem permissions.
Application-level permissions must be defined in the Task Role (taskRoleArn).
2
Determine container orchestration requirements.
The ECS container agent needs to pull the image from a private Amazon ECR repository and send logs to CloudWatch Logs, requiring ECR pull permissions and CloudWatch logs permission.
Agent-level and launch-level permissions must be defined in the Task Execution Role (executionRoleArn).
3
Verify trust policy for ECS Fargate.
Both IAM roles must trust the ecs-tasks.amazonaws.com service principal.
AWS Fargate is a serverless execution environment where tasks are managed directly by ECS, meaning the roles must trust the ECS tasks principal rather than the EC2 instance principal.

Key Concept

ECS Task Role vs Task Execution Role
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic