Examkin

Question

Difficulty: EasyIAM Policies and Roles

A developer is configuring an Amazon Elastic Container Service (ECS) task definition for a containerized application. The application code needs to retrieve objects from an Amazon S3 bucket at runtime. Additionally, the ECS container agent requires permissions to pull the private container image from Amazon Elastic Container Registry (ECR) to launch the task. Which configuration should the developer use to grant the appropriate permissions?

  1. A
    Assign an IAM role with Amazon S3 permissions to the Task Execution Role, and assign an IAM role with Amazon ECR permissions to the Task Role.
  2. B
    Configure the container's environment variables with the AWS Access Key ID and Secret Access Key of an IAM user that has both Amazon S3 and Amazon ECR permissions.
  3. Assign an IAM role with Amazon S3 permissions to the Task Role, and assign an IAM role with Amazon ECR permissions to the Task Execution Role.Answer
  4. D
    Assign an IAM role with both Amazon S3 and Amazon ECR permissions to the Task Execution Role, and leave the Task Role blank.

Answer

Assign an IAM role with Amazon S3 permissions to the Task Role, and assign an IAM role with Amazon ECR permissions to the Task Execution Role.
The correct configuration requires assigning the application-specific permissions (Amazon S3 access) to the ECS Task Role so the containerized application code can access S3 at runtime. The container agent itself requires permissions to pull images from Amazon ECR, which must be assigned to the ECS Task Execution Role.

Step-by-Step Solution

1
Identify the resource-access requirements for the containerized application.
The application code itself needs to access Amazon S3 at runtime.
Application-level permissions must be mapped to the ECS Task Role.
2
Identify the resource-access requirements for the ECS container agent.
The ECS agent needs to pull the Docker image from Amazon ECR before the container starts.
Agent-level infrastructure permissions must be mapped to the ECS Task Execution Role.
3
Combine the configurations in the ECS task definition.
Assign S3 permissions to the Task Role and ECR permissions to the Task Execution Role.
This setup aligns with the principle of least privilege and ensures correct authorization separation.

Key Concept

ECS Task Role vs Task Execution Role
Estimated Time:1m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic