Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is configuring an Amazon ECS task definition to deploy a microservice to AWS Fargate. The container image is stored in a private Amazon ECR repository. During startup, the containerized application must read database credentials from AWS Secrets Manager. The developer wants to inject these credentials as container environment variables without exposing them in plaintext or embedding them in the container image.

Which two actions should the developer take to configure the task definition and IAM roles for this deployment? (Select TWO.)

  1. Configure the ECS Task Execution Role with a policy that allows the secretsmanager:GetSecretValue action.Answer
  2. In the container definition, use the secrets parameter to reference the database credential secret and map it to a container environment variable.Answer
  3. C
    Configure the ECS Task Role with a policy that allows the ecr:GetDownloadUrlForLayer and ecr:BatchGetImage actions.
  4. D
    Configure the trust policy of the ECS Task Execution Role to trust the service principal ecs.amazonaws.com.
  5. E
    In the container definition, specify the database credentials in plaintext within the environment parameter to pass them directly to the container.

Answer

The correct configurations are to configure the ECS Task Execution Role with a policy that allows the secretsmanager:GetSecretValue action, and to reference the database credential secret using the secrets parameter in the container definition to map it to an environment variable.
The ECS agent is responsible for both pulling the container image from Amazon ECR and retrieving database credentials from Secrets Manager to inject them as environment variables during container creation. Therefore, these permissions must be granted to the ECS Task Execution Role, and the task definition container definition must use the secrets parameter to map the secret ARN to the desired environment variable name.

Step-by-Step Solution

1
Understand who performs image pulls and secrets retrieval.
The ECS agent performs these tasks during task initialization, not the containerized application code.
This determines that permissions for pulling ECR images and retrieving Secrets Manager secrets belong in the ECS Task Execution Role rather than the ECS Task Role.
2
Identify the proper IAM permissions for Secrets Manager retrieval.
Assign the secretsmanager:GetSecretValue permission to the ECS Task Execution Role policy.
The ECS agent needs this permission to call AWS Secrets Manager to retrieve the credential values.
3
Determine the proper method to inject secrets into the container definition.
Use the secrets parameter in the container definition to map the secret ARN to the environment variable.
This keeps credentials secure by injecting them at runtime, preventing the exposure of plaintext credentials in the task definition.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role, and secure injection of secrets into ECS containers.
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic