Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is deploying a containerized application to Amazon ECS on AWS Fargate. The application code reads configuration files from an Amazon S3 bucket. Additionally, the container definition is configured to retrieve a database password from AWS Systems Manager Parameter Store and inject it as an environment variable at startup. Which configuration of IAM roles and trust relationships is required for the application to run successfully?

  1. Attach the S3 access policy to the ECS Task Role, and attach the Parameter Store access policy to the ECS Task Execution Role. Configure both roles to trust the ECS tasks service (ecs-tasks.amazonaws.com).Answer
  2. B
    Attach both the S3 access policy and the Parameter Store access policy to the ECS Task Execution Role. Leave the ECS Task Role unconfigured.
  3. C
    Attach the S3 access policy to the ECS Task Role, and attach the Parameter Store access policy to the ECS Task Execution Role. Configure both roles to trust the Amazon EC2 service (ec2.amazonaws.com).
  4. D
    Embed static AWS credentials directly into the application code for S3 access, and hardcode the database password as a plaintext environment variable in the Dockerfile.

Answer

Attach the S3 access policy to the ECS Task Role, and attach the Parameter Store access policy to the ECS Task Execution Role. Configure both roles to trust the ECS tasks service (ecs-tasks.amazonaws.com).
The correct option correctly separates the runtime application permissions (ECS Task Role for S3) from the ECS agent bootstrap permissions (ECS Task Execution Role for Parameter Store), and configures both roles to trust the ECS tasks service principal (ecs-tasks.amazonaws.com).

Step-by-Step Solution

1
Determine the role required for the application code to access S3.
The application code running inside the container needs runtime permissions, which are provided by the ECS Task Role.
The Task Role credentials are injected into the container's environment for the AWS SDK to use.
2
Determine the role required for the container agent to fetch secrets.
The ECS container agent needs permissions to pull the secret from Parameter Store at startup, which is provided by the ECS Task Execution Role.
The Task Execution Role grants the ECS infrastructure permissions to prepare the container environment.
3
Verify the IAM trust relationships.
Both roles must trust the ecs-tasks.amazonaws.com service principal.
This allows Amazon ECS to assume the specified IAM roles on behalf of the tasks.

Key Concept

ECS Task Role vs Task Execution Role
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic