Examkin

Question

Difficulty: EasyAmazon ECS and Docker Deployment

A developer is configuring a task definition to run a microservice on Amazon ECS using the AWS Fargate launch type. The microservice application code needs to send messages to an Amazon SQS queue. How should the developer grant the application code the required SQS permissions?

  1. A
    Assign the permissions to the IAM role specified in the executionRoleArn parameter of the task definition.
  2. B
    Embed an IAM user's access key credentials directly in the application code configuration inside the container.
  3. Assign the permissions to the IAM role specified in the taskRoleArn parameter of the task definition.Answer
  4. D
    Modify the SQS queue's resource-based policy to trust the Amazon Resource Name (ARN) of the ECS cluster.

Answer

Assign the permissions to the IAM role specified in the taskRoleArn parameter of the task definition.
The correct option is the one specifying the use of the taskRoleArn parameter. When deploying containers on Amazon ECS, the Task Role (taskRoleArn) grants the containerized application permissions to make API requests to other AWS services like Amazon SQS. The AWS SDK inside the container automatically retrieves temporary credentials associated with this role.

Step-by-Step Solution

1
Identify the resource requiring credentials.
The application code running inside the ECS container needs to interact with Amazon SQS.
This determines whether the task agent permissions or the application permissions are needed.
2
Distinguish between ECS Task Role and ECS Task Execution Role.
The Task Role (taskRoleArn) is designed for the application inside the container, whereas the Task Execution Role (executionRoleArn) is for the ECS agent itself.
Choosing the correct role ensures the application can retrieve temporary credentials for SQS.
3
Select the appropriate parameter in the task definition.
Apply the IAM policy with SQS write permissions to the IAM role specified by taskRoleArn.
This secures the containerized application without exposing static credentials or misconfiguring agent roles.

Key Concept

ECS Task Role vs. ECS Task Execution Role
Estimated Time:45s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic