Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A company is migrating a containerized web application to run on Amazon ECS using the Amazon EC2 launch type. Multiple instances of the application task must run on each container instance, and the tasks are configured to use the bridge network mode. The application code requires access to a database password stored in AWS Secrets Manager and must perform read operations on an Amazon DynamoDB table. Which two configurations are required to support this deployment?

  1. Set the container port to 80 and the host port to 0 (or leave it blank) in the task definition port mapping.Answer
  2. Configure the task definition's Task Role (taskRoleArn) with the IAM policies required to access the Amazon DynamoDB table and AWS Secrets Manager.Answer
  3. C
    Configure the task definition's Task Execution Role (executionRoleArn) with the IAM policies required to access the Amazon DynamoDB table and AWS Secrets Manager.
  4. D
    Configure the IAM role for application permissions with a trust policy that allows the ec2.amazonaws.com service principal to assume the role.
  5. E
    Store the database password as a plaintext environment variable directly in the container definition of the ECS task definition.

Answer

Configure dynamic port mapping by setting the host port to 0 or leaving it blank, and assign the required IAM policies to the ECS Task Role (taskRoleArn) with a trust policy for ecs-tasks.amazonaws.com.
To support running multiple instances of the container on a single EC2 host using the bridge network mode, dynamic host port mapping is required. This is achieved by setting the host port to 0 or leaving it blank in the task definition port mapping, which allows the ECS agent to automatically map the container port to a random ephemeral port on the host. Furthermore, the application container requires AWS credentials at runtime to query the DynamoDB table and fetch secrets from Secrets Manager. These application-level permissions must be defined in an IAM role assigned to the taskRoleArn (Task Role) parameter of the task definition.

Step-by-Step Solution

1
Configure the port mapping in the task definition for bridge network mode with the host port set to 0 or left blank.
Enables dynamic port mapping, letting the ECS agent bind the container's port to a random host port.
Allows multiple task instances to run on the same EC2 instance without port conflicts.
2
Create an IAM role that trusts the ecs-tasks.amazonaws.com service principal and attach permission policies for DynamoDB and Secrets Manager.
Creates a role that ECS tasks can assume to perform API operations on AWS services.
Secures application credentials by avoiding hardcoded values and granting access via temporary credentials.
3
Assign this role to the taskRoleArn parameter in the ECS task definition.
Ensures the containerized application executes with the permissions defined in the IAM role.
Maintains the separation of concerns by assigning application access to the Task Role rather than the Task Execution Role.

Key Concept

ECS Task Role vs Task Execution Role and Bridge Network Mode Port Mapping
Estimated Time:2m 0s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic