Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A software engineer is building a deployment package for an Amazon ECS service running on AWS Fargate. The application container must write logging metadata to a shared Amazon S3 bucket during execution. Additionally, the container needs to retrieve a database password stored in AWS Systems Manager Parameter Store during initialization without hardcoding it. Which of the following identity and access configuration actions must the engineer perform? (Select TWO.)

  1. Attach an IAM policy granting S3 write access to the ECS Task Role, and reference this role as the taskRoleArn in the task definition.Answer
  2. Attach an IAM policy granting Systems Manager Parameter Store access to the ECS Task Execution Role, and reference the parameter in the secrets section of the container definition.Answer
  3. C
    Attach the IAM policy granting S3 write access to the ECS Task Execution Role to allow the container to upload files during task execution.
  4. D
    Define the AWS access key and secret key as static environment variables within the Dockerfile to allow the containerized application to authenticate with S3.
  5. E
    Configure the trust relationship of the IAM role used for S3 access to trust the ec2.amazonaws.com service principal so the task can assume the role.

Answer

Attach an IAM policy granting S3 write access to the ECS Task Role, and attach an IAM policy granting Systems Manager Parameter Store access to the ECS Task Execution Role.
The ECS Task Role is assumed by the containerized application itself at runtime to interact with AWS services like Amazon S3. The ECS Task Execution Role is used by the ECS container agent to make AWS API calls on your behalf, such as pulling images from Amazon ECR or retrieving secrets/parameters from Systems Manager Parameter Store or Secrets Manager during the container provisioning phase.

Step-by-Step Solution

1
Define the permissions required by the application code at runtime.
An IAM policy with s3:PutObject is identified.
This permission is needed for application logic execution.
2
Associate the runtime S3 permissions with the ECS Task Role.
The ECS Task Role is configured with the S3 policy and referenced in the task definition.
The containerized application inherits these permissions at runtime.
3
Define the permissions required by the ECS agent at launch time.
An IAM policy with ssm:GetParameters is identified.
This permission is needed for the ECS agent to fetch parameters and inject them as environment variables before starting the container.
4
Associate the startup parameter retrieval permissions with the ECS Task Execution Role.
The ECS Task Execution Role is configured with the SSM policy and referenced in the task definition.
The ECS agent successfully pulls the parameters during initialization.

Key Concept

Differentiating between the ECS Task Role and the ECS Task Execution Role for application runtime permissions versus container agent startup permissions.
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic