Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A development team is deploying a containerized worker application to Amazon ECS using the AWS Fargate launch type. The application is designed to process messages from an Amazon SQS queue. The container image is hosted in a private Amazon Elastic Container Registry (Amazon ECR) repository, and the ECS agent must send container logs to Amazon CloudWatch Logs. Which of the following IAM configurations are required for this deployment to succeed? (Select TWO.)

  1. Configure the ECS Task Role (taskRoleArn) with a policy that allows SQS actions (sqs:ReceiveMessage, sqs:DeleteMessage), and establish a trust relationship allowing ecs-tasks.amazonaws.com to assume the role.Answer
  2. Configure the ECS Task Execution Role (executionRoleArn) with a policy that allows ECR actions (ecr:GetAuthorizationToken, ecr:BatchGetImage) and CloudWatch Logs actions (logs:CreateLogStream, logs:PutLogEvents), and trust ecs-tasks.amazonaws.com.Answer
  3. C
    Configure the ECS Task Execution Role (executionRoleArn) with a policy that allows SQS actions (sqs:ReceiveMessage, sqs:DeleteMessage), as containerized applications automatically inherit permissions from the execution role.
  4. D
    Configure the ECS Task Role (taskRoleArn) with a policy that allows ECR image pull permissions, because the container runtime must possess credentials to download its own image during container creation.
  5. E
    Hardcode temporary credentials retrieved from AWS STS using a custom script inside the Dockerfile's ENTRYPOINT to bypass IAM role configuration.

Answer

Configure the ECS Task Role with a policy allowing SQS actions and a trust policy for the ECS tasks service principal, and configure the ECS Task Execution Role with ECR and CloudWatch Logs permissions along with a trust policy for the ECS tasks service principal.
For an ECS container running on Fargate, the application code inherits permissions from the Task Role (taskRoleArn), while the ECS agent requires permissions from the Task Execution Role (executionRoleArn). Therefore, the Task Role must be configured to allow the application's SQS calls, and the Task Execution Role must be configured to allow the ECS agent's ECR pull and CloudWatch logging actions. Both roles require trust policies that allow the ecs-tasks.amazonaws.com service principal to assume them.

Step-by-Step Solution

1
Determine the resource access required by the application code executing inside the container.
The application code needs to communicate with Amazon SQS to receive and delete messages, requiring an ECS Task Role.
Permissions for resource access by application code must be granted via the taskRoleArn parameter.
2
Determine the resource access required by the ECS agent/infrastructure to instantiate and monitor the container.
The ECS agent needs to authenticate with Amazon ECR to pull the image and write to CloudWatch Logs, requiring an ECS Task Execution Role.
Permissions for infrastructure operations performed by the ECS container agent must be granted via the executionRoleArn parameter.
3
Configure trust policies for both IAM roles to allow the ECS service to assume them.
Both roles must have trust relationships defined for the ecs-tasks.amazonaws.com service principal.
AWS services require explicit trust relationships to assume roles on behalf of resources.

Key Concept

Distinguishing between the ECS Task Role and the ECS Task Execution Role.
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic