Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is configuring an Amazon ECS task definition to deploy a backend service to AWS Fargate. The service requires sensitive database credentials stored in AWS Systems Manager Parameter Store to be injected as environment variables when the container starts. Additionally, the service logs must be sent directly to Amazon CloudWatch Logs. Which TWO configurations must the developer implement to meet these requirements?

  1. Add the ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role.Answer
  2. In the task definition, define the secrets parameter inside the container definition referencing the Parameter Store parameter ARNs, and configure the logConfiguration parameter to use the awslogs log driver.Answer
  3. C
    Add the ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Role.
  4. D
    Add a trust policy to the ECS Task Role that allows the Systems Manager service principal (ssm.amazonaws.com) to assume the role.
  5. E
    Store the database credentials in the environment parameter of the task definition, and configure the task definition to use the host network mode to forward logs.

Answer

The correct configurations are: adding ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role, and defining the secrets parameter referencing the Parameter Store ARNs along with the awslogs log driver in the container definition.
The correct configuration requires adding the necessary permissions to the ECS Task Execution Role, as this is the IAM role used by the ECS container agent to call AWS APIs (like SSM to pull parameters and CloudWatch to write logs) before the containerized application runs. Additionally, the task definition must use the 'secrets' parameter to declare the environment variables mapped to SSM parameters, and configure 'logConfiguration' with the 'awslogs' driver to natively forward standard output and standard error stream logs.

Step-by-Step Solution

1
Determine which role requires permissions for startup operations.
The ECS Task Execution Role is identified because the ECS container agent (not the application code) is responsible for pulling secrets at startup and routing logs.
Understanding the division of responsibilities between the Task Execution Role (agent permissions) and the Task Role (application permissions) is key.
2
Identify the proper configuration syntax in the task definition for secrets and logging.
The 'secrets' parameter is used to map Parameter Store values to environment variables, and the 'logConfiguration' with 'awslogs' driver is used for CloudWatch Logs.
This matches the native ECS integration requirements for secure environment variables and log routing.
3
Grant the necessary IAM permissions to the correct role.
Attach an IAM policy with ssm:GetParameters and logs:PutLogEvents (along with logs:CreateLogStream) to the Task Execution Role.
The ECS agent requires these specific permissions to retrieve the parameters and write log data to CloudWatch.

Key Concept

ECS Task Role vs. Task Execution Role & ECS Secret Injection
Estimated Time:2m 0s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic