Examkin

Question

Difficulty: HardIAM Policies and Roles

An application running on an Amazon ECS container using AWS Fargate in Account AA (111122223333111122223333) needs to write objects to an Amazon S3 bucket in Account BB (444455556666444455556666). The application code uses the AWS SDK to call the AWS Security Token Service (STS) `AssumeRole` API to assume an IAM role named `CrossAccountS3Writer` in Account BB. However, the application receives an `AccessDenied` error on the `AssumeRole` call.

The ECS task definition is configured with the `taskRoleArn` parameter set to `arn:aws:iam::111122223333:role/ecsTaskRole` and the `executionRoleArn` parameter set to `arn:aws:iam::111122223333:role/ecsTaskExecutionRole`.

Which two actions are required to resolve this access issue and allow the application to write to the S3 bucket? (Select TWO.)

  1. Update the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskRole.Answer
  2. B
    Update the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskExecutionRole.
  3. Modify the application code to initialize the S3 client using the temporary security credentials returned by the AssumeRole call.Answer
  4. D
    Hardcode a set of long-term IAM user access keys from Account B directly in the application configuration files to bypass STS.
  5. E
    Attach the AmazonS3FullAccess policy to the ecsTaskExecutionRole in Account A to authorize the S3 client.

Answer

Update the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskRole, and modify the application code to initialize the S3 client using the temporary security credentials returned by the AssumeRole call.
The correct options involve updating the trust policy of the CrossAccountS3Writer role in Account B to trust the principal arn:aws:iam::111122223333:role/ecsTaskRole, and modifying the application code to initialize the S3 client using the temporary security credentials returned by the AssumeRole call. The application runs using the container task role (ecsTaskRole), so the trust relationship must target this role. The SDK must also explicitly use the temporary credentials retrieved from AWS STS to interact with the S3 bucket.

Step-by-Step Solution

1
Differentiate between the ECS Task Role and the ECS Task Execution Role.
The application code running inside the container uses the ECS Task Role for AWS API permissions. The ECS Task Execution Role is used only by the container agent for setup tasks.
This determines which role identity makes the sts:AssumeRole call.
2
Configure the trust relationship in Account B.
The role CrossAccountS3Writer in Account B must list the ECS Task Role (arn:aws:iam::111122223333:role/ecsTaskRole) as a trusted entity in its assume role policy document.
This permits the application running under the Task Role identity to assume the target role.
3
Utilize temporary credentials in the application.
Capture the AccessKeyId, SecretAccessKey, and SessionToken returned by the AssumeRole API call and pass them to the AWS SDK client builder.
The client must use these temporary credentials rather than its default credentials to access the cross-account S3 bucket.

Key Concept

Cross-account access and task-level role delegation in Amazon ECS
Rate this question

Topics

IAM Policies and Roles

More questions from this topic