Examkin

Question

Difficulty: EasyResolving IAM and Authorization Failures

A developer has deployed a containerized application to Amazon ECS on AWS Fargate. The application code needs to retrieve customer records from an Amazon DynamoDB table. During execution, the container logs display an AccessDeniedException when attempting to call DynamoDB API operations. The developer verifies that the ECS task execution role has an attached policy allowing the necessary DynamoDB permissions. How should the developer resolve this authorization failure?

  1. A
    Ensure the DynamoDB policy is attached to the ECS task execution role and configure the container definition to enable runtime credential sharing.
  2. Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.Answer
  3. C
    Modify the trust relationship of the ECS task execution role to allow the DynamoDB service to assume the role.
  4. D
    Configure an Amazon Cognito Identity Pool to exchange credentials for the container and map them to the task execution role.

Answer

Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.
The correct answer is correct because the ECS task role is designed specifically to grant AWS API permissions to the application code running inside containerized tasks. The ECS task execution role is intended for the container agent itself to pull images from Amazon ECR and push logs to CloudWatch.

Step-by-Step Solution

1
Distinguish between ECS Task Role and ECS Task Execution Role.
Identify that the Task Role is used by the application code running inside the container, whereas the Task Execution Role is used by the ECS container agent for infrastructure tasks (like pulling ECR images and writing CloudWatch logs).
Correctly identifying which identity runs the application code is necessary to assign API permissions.
2
Review the current IAM policy attachment.
Verify that the policy permitting DynamoDB actions is attached to the Task Execution Role, which explains why the application receives an AccessDeniedException.
Locating where the permission is incorrectly applied helps determine the required fix.
3
Migrate the permission policy to the ECS Task Role.
The application code is now successfully authorized to query the DynamoDB table.
Attaching permissions to the Task Role grants the running container the access credentials it needs.

Key Concept

ECS Task Role vs. ECS Task Execution Role
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic