Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A software engineer is configuring an Amazon ECS task definition to deploy a containerized application to AWS Fargate. To simplify log management, the engineer configures the container to use the `awslogs` log driver and sets the `awslogs-create-group` option to `true` in the log configuration. The task definition specifies a custom IAM role for the task execution role. When the engineer attempts to launch the task, the task fails to start and remains in the `STOPPED` state, citing an authorization error related to CloudWatch Logs.

Which configuration change will resolve this deployment issue?

  1. A
    Add the `logs:CreateLogGroup` permission to the custom IAM role assigned as the ECS task role.
  2. B
    Update the ECS task execution role trust policy to allow the `logs.amazonaws.com` service principal to assume the role.
  3. Add the `logs:CreateLogGroup` permission to the custom IAM role assigned as the task execution role.Answer
  4. D
    Configure the application code inside the Docker container to use the AWS SDK to verify and create the CloudWatch log group at startup.

Answer

Add the `logs:CreateLogGroup` permission to the custom IAM role assigned as the task execution role.
The correct answer is to add the `logs:CreateLogGroup` permission to the task execution role. When the `awslogs` log driver is configured with `awslogs-create-group` set to `true`, the Amazon ECS container agent automatically attempts to create the specified log group in CloudWatch. Because the agent performs this infrastructure setup action, it requires authorization via the task execution role. The default managed policy `AmazonECSTaskExecutionRolePolicy` only provides permissions to create log streams and put log events, meaning that `logs:CreateLogGroup` must be explicitly added to a custom policy attached to the task execution role.

Step-by-Step Solution

1
Differentiate between the roles: Identify that the ECS agent is responsible for creating the log group during container startup, which requires permissions in the Task Execution Role.
The Task Execution Role is selected as the target for IAM policy modification instead of the Task Role.
The Task Execution Role is used by the ECS agent for lifecycle tasks like pulling ECR images and writing logs, whereas the Task Role is for application-level AWS API calls.
2
Analyze the policy permissions: Review the managed policy `AmazonECSTaskExecutionRolePolicy` and notice it only grants `logs:CreateLogStream` and `logs:PutLogEvents`.
Confirm that `logs:CreateLogGroup` is missing from the default policies when configuring `awslogs-create-group` to `true`.
If `awslogs-create-group` is set to `true`, the agent needs to explicitly create the log group, which requires a custom inline or managed policy with the `logs:CreateLogGroup` action.
3
Apply the IAM policy updates: Attach a policy containing `logs:CreateLogGroup` to the ECS Task Execution Role.
The ECS task successfully creates the log group and transitions to the `RUNNING` state.
Providing the necessary action to the Task Execution Role grants the ECS agent the authorization it needs to complete task provisioning.

Key Concept

Understanding the division of responsibilities and IAM permissions between the Amazon ECS Task Execution Role and the Task Role when configuring logging.
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic