Examkin

Question

Difficulty: HardAmazon ECS and Docker Deployment

A developer is deploying a microservices application to Amazon ECS using the AWS Fargate launch type. The Docker image for the application is hosted in a private Docker Hub repository. The credentials for the private repository are securely stored in AWS Secrets Manager. The developer needs to configure the ECS task definition and IAM permissions so that the Amazon ECS container agent can pull the image during task startup.

Which two actions should the developer take to meet these requirements?

  1. In the container definition of the ECS task definition, configure the repositoryCredentials parameter and set the credentialsParameter property to the ARN of the AWS Secrets Manager secret containing the registry credentials.Answer
  2. Attach an IAM policy to the ECS task execution role that grants the secretsmanager:GetSecretValue permission for the secret, and configure the role's trust policy to trust the ecs-tasks.amazonaws.com service principal.Answer
  3. C
    Attach an IAM policy to the ECS task role that grants the secretsmanager:GetSecretValue permission, and configure the container definition to reference the secret in the container's environment variables.
  4. D
    In the container definition of the ECS task definition, configure the repositoryCredentials parameter and set the credentialsParameter property to the name of an AWS Systems Manager Parameter Store parameter containing the registry credentials.
  5. E
    Attach an IAM policy to the ECS task execution role that grants the secretsmanager:GetSecretValue permission, and configure the role's trust policy to trust the ec2.amazonaws.com service principal.

Answer

The developer must configure the repositoryCredentials parameter in the container definition to reference the Secrets Manager secret ARN, and attach a policy to the Task Execution Role allowing secretsmanager:GetSecretValue with a trust policy for ecs-tasks.amazonaws.com.
To pull container images from private external registries like Docker Hub on ECS Fargate, the container agent requires credentials. The correct procedure is to reference the AWS Secrets Manager secret ARN inside the repositoryCredentials block of the task definition. Because this action is performed by the Amazon ECS container agent before the container runs, the permissions (secretsmanager:GetSecretValue) must be granted to the ECS Task Execution Role, and this role must trust the ecs-tasks.amazonaws.com service principal to allow ECS to assume it.

Step-by-Step Solution

1
Determine which role is responsible for task initialization and image pulling.
The Task Execution Role is identified as the role assumed by the ECS agent to pull images and write logs, whereas the Task Role is for application runtime permissions.
This prevents assigning secret retrieval permissions to the wrong role (Task Role).
2
Identify the proper parameter for private registry authentication in the ECS task definition.
The repositoryCredentials parameter inside the container definition is selected, which requires the ARN of an AWS Secrets Manager secret.
This establishes that SSM Parameter Store is invalid for private registry credentials in ECS.
3
Configure the trust relationship and permissions for the Task Execution Role.
The Task Execution Role is granted secretsmanager:GetSecretValue permission, and its trust policy is configured to trust the ecs-tasks.amazonaws.com service principal.
This allows the ECS service to assume the execution role and retrieve the registry credentials during startup on Fargate.

Key Concept

Configuring private registry authentication on ECS Fargate requires the repositoryCredentials property in the task definition referencing a Secrets Manager secret, and granting the secretsmanager:GetSecretValue permission to the ECS Task Execution Role.
Estimated Time:2m 30s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic