Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is deploying a containerized microservice to Amazon ECS on AWS Fargate. The application code inside the container must read and write data to an Amazon DynamoDB table. During startup, the Amazon ECS container agent must retrieve sensitive API keys from AWS Secrets Manager to inject as environment variables and send container logs to Amazon CloudWatch Logs. Which of the following configurations must the developer perform to meet these requirements securely? (Select TWO.)

  1. Associate an IAM role containing DynamoDB read and write permissions as the Task Role (taskRoleArn) in the task definition.Answer
  2. Associate an IAM role containing Secrets Manager decryption and CloudWatch Logs creation permissions as the Task Execution Role (executionRoleArn) in the task definition.Answer
  3. C
    Associate an IAM role containing DynamoDB read and write permissions as the Task Execution Role (executionRoleArn) in the task definition.
  4. D
    Configure the trust policy of the Task Role to allow the Systems Manager service principal (ssm.amazonaws.com) to assume the role.
  5. E
    Store the AWS access keys in the application's configuration file inside the Docker container to authenticate DynamoDB SDK requests.

Answer

The developer must associate the IAM role containing DynamoDB permissions as the Task Role (taskRoleArn) and associate the IAM role containing Secrets Manager and CloudWatch permissions as the Task Execution Role (executionRoleArn).
The correct configurations involve assigning the correct responsibilities to the Task Role and the Task Execution Role. The Task Role is used by the containers running inside the task to make AWS API calls, so the permission to read and write to the DynamoDB table must be attached to the Task Role. The Task Execution Role is used by the Amazon ECS container agent to perform actions on behalf of the task before the containers start, such as pulling the container image, writing logs to CloudWatch Logs, and retrieving secrets from Secrets Manager to inject as environment variables.

Step-by-Step Solution

1
Analyze the requirements for permissions that the containerized application code needs during execution.
The application code needs to read and write to Amazon DynamoDB.
Permissions for AWS API calls made by the application code must be granted via the ECS Task Role.
2
Analyze the requirements for permissions that the ECS agent needs to set up the container.
The ECS agent needs to retrieve secrets from Secrets Manager and write logs to CloudWatch Logs.
Permissions for pulling images, retrieving secrets for container initialization, and writing logs are managed by the ECS Task Execution Role.
3
Identify the correct configurations that map these roles to the task definition.
The DynamoDB role is associated with taskRoleArn, and the role containing Secrets Manager and CloudWatch Logs permissions is associated with executionRoleArn.
This configuration correctly separates runtime application permissions from container initialization permissions.

Key Concept

Separation of concerns between the ECS Task Role and the ECS Task Execution Role.
Estimated Time:2m 0s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic