Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

An application deployed on Amazon ECS using AWS Fargate starts successfully, but the application code fails with an AccessDeniedException when attempting to read messages from an Amazon SQS queue. The developer verifies that the SQS queue policy does not explicitly deny access. The task definition currently includes an IAM role specified in the executionRoleArn parameter which has the AmazonSQSReadOnlyAccess policy attached. Which of the following actions should the developer take to resolve this authorization failure?

  1. A
    Modify the trust policy of the ECS task execution role to allow the SQS service principal to assume the role.
  2. B
    Configure an Amazon Cognito Identity Pool to exchange the container's execution credentials for temporary SQS credentials.
  3. Specify an IAM role with SQS permissions in the taskRoleArn parameter of the task definition.Answer
  4. D
    Add sqs:ReceiveMessage permissions to the IAM role specified in the executionRoleArn parameter of the task definition.

Answer

Specify an IAM role with SQS permissions in the taskRoleArn parameter of the task definition.
The correct answer is to specify the SQS permission policy on the task role (taskRoleArn). The ECS Task Role is designed to grant AWS API permissions to the application code running inside the container. In contrast, the ECS Task Execution Role (executionRoleArn) is used by the ECS container agent for actions like pulling container images from Amazon ECR and sending logs to CloudWatch.

Step-by-Step Solution

1
Identify the distinction between the ECS Task Execution Role and the ECS Task Role.
The Task Execution Role is used by the ECS container agent (e.g., to pull ECR images, send logs to CloudWatch, retrieve secrets), whereas the Task Role is assumed by the application code running inside the container.
Resolving permission issues requires identifying which role credentials the failing API call is using.
2
Locate where application-level permissions are configured in the ECS task definition.
The parameter taskRoleArn holds the IAM role containing permission policies for AWS services like SQS, S3, or DynamoDB invoked by the application.
Configuring permissions on executionRoleArn will result in authorization failures for the containerized application.
3
Assign the correct IAM role with SQS permissions to the taskRoleArn parameter and deploy the task.
The containerized application successfully receives credentials with sqs:ReceiveMessage permissions from the task metadata endpoint.
This links the correct permissions to the running application process.

Key Concept

ECS Task Role vs Task Execution Role permission boundaries
Estimated Time:1m 30s
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic