Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application is packaged in a Docker image stored in a private Docker Hub repository. During task initialization, the Amazon ECS agent must pull this image using credentials stored in AWS Secrets Manager. Once running, the application code must publish messages to an Amazon SQS queue. Which combination of IAM configurations should the developer implement to meet these requirements? (Select TWO.)

  1. Attach a policy to the ECS task execution role that allows the secretsmanager:GetSecretValue action on the secret containing the private registry credentials.Answer
  2. Attach a policy to the ECS task role that allows the sqs:SendMessage action on the Amazon SQS queue.Answer
  3. C
    Attach a policy to the ECS task role that allows the secretsmanager:GetSecretValue action on the secret containing the private registry credentials.
  4. D
    Attach a policy to the ECS task execution role that allows the sqs:SendMessage action on the Amazon SQS queue.
  5. E
    Modify the trust policy of the ECS task execution role to trust the sqs.amazonaws.com service principal.

Answer

To configure this setup correctly, the developer must attach the secretsmanager:GetSecretValue permission to the ECS task execution role to allow the ECS agent to retrieve the private registry credentials, and attach the sqs:SendMessage permission to the ECS task role to allow the application code to write to the SQS queue.
The correct configurations involve assigning the registry credentials access to the ECS task execution role and assigning SQS permissions to the ECS task role. The ECS task execution role is assumed by the ECS agent to perform actions such as pulling the container image and pulling secrets from Secrets Manager. The ECS task role is assumed by the application running inside the container, granting it permissions to interact with AWS resources like SQS.

Step-by-Step Solution

1
Determine the role required for container image pull authentication.
The ECS container agent handles pulling the image from the private registry during task initialization, which requires accessing the secret credentials. This requires the ECS Task Execution Role.
Permissions needed by the ECS daemon/agent (such as pulling images and reading secrets to start containers) must be defined in the Task Execution Role.
2
Determine the role required for SQS message publishing.
The application code running inside the container performs the SQS operations once the container starts. This requires the ECS Task Role.
Permissions needed by the containerized application code itself (such as interacting with AWS APIs like DynamoDB, S3, or SQS) must be defined in the Task Role.
3
Select the two correct configuration steps.
Assign secrets retrieval to the task execution role, and assign SQS send message permission to the task role.
This correctly maps permissions based on which entity (the ECS agent vs. the application code) performs each action.

Key Concept

ECS Task Role vs. Task Execution Role
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic