Examkin

Question

Difficulty: EasyAmazon ECS and Docker Deployment

A web application is deployed as a Docker container on Amazon ECS using the AWS Fargate launch type. The application's Go code utilizes the AWS SDK to retrieve configuration files from an Amazon S3 bucket. Which IAM role must be configured with Amazon S3 read permissions to allow the application code to access the bucket?

  1. The ECS Task RoleAnswer
  2. B
    The ECS Task Execution Role
  3. C
    An IAM Role with a trust policy configured for Amazon EC2
  4. D
    An IAM User with access keys passed into the container as environment variables

Answer

The ECS Task Role
The ECS Task Role is the IAM role assumed by the container itself. AWS SDKs running inside the container retrieve credentials from this role automatically, allowing the application code to interact with AWS services like Amazon S3.

Step-by-Step Solution

1
Identify the entity requiring access to the Amazon S3 bucket.
The application code running inside the container requires access to read S3 objects.
This determines whether we need a role for the application code or a role for the ECS infrastructure agent.
2
Select the ECS task parameter designed for application-level AWS API permissions.
The ECS Task Role (taskRoleArn) provides temporary credentials directly to the containerized application.
The Task Execution Role is for ECS agent tasks (like image pulls and logging), whereas the Task Role is for application code tasks.

Key Concept

ECS Task Role vs Task Execution Role
Estimated Time:45s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic