Examkin

Question

Difficulty: HardAmazon ECS and Docker Deployment

A developer is deploying a microservices application to Amazon ECS using the AWS Fargate launch type in AWS Account A. The container image is stored in a private Amazon Elastic Container Registry (Amazon ECR) repository located in AWS Account B. During deployment, the ECS tasks fail to transition to the RUNNING state, and the task status shows an error indicating that the container image cannot be pulled from the remote registry. Which combination of steps should the developer perform to resolve this authentication and access issue? (Select TWO.)

  1. Configure the ECS task execution role in Account A with an IAM policy that allows the ecr:GetAuthorizationToken action on all resources, and the ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage actions on the Account B repository.Answer
  2. Configure the ECR repository policy in Account B to grant read-only access for the ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage actions to the ECS task execution role ARN from Account A.Answer
  3. C
    Configure the ECS task role in Account A with an IAM policy that allows ECR API calls, and attach it to the container definition under the taskRoleArn parameter.
  4. D
    Modify the trust policy of the ECS task execution role in Account A to allow the ecr.amazonaws.com service principal to assume the role.
  5. E
    Create a secret in AWS Secrets Manager in Account A containing cross-account ECR registry credentials, and reference the secret in the container definition's repositoryCredentials parameter.

Answer

Configure the ECS task execution role in Account A with permissions to pull the ECR image, and configure the ECR repository policy in Account B to grant access to Account A's task execution role.
To pull private ECR images cross-account, the ECS task execution role in Account A needs permissions to retrieve the authorization token and access the repository layers. Simultaneously, the repository policy in Account B must allow access from the Account A task execution role principal.

Step-by-Step Solution

1
Ensure the ECS Task Execution Role in Account A has permissions to authenticate and pull from ECR.
The ECS agent can invoke ecr:GetAuthorizationToken (on resource '*') to authenticate and has read permissions on the target repository.
The task execution role provides the ECS agent with the required credentials to pull images and push logs before the container code executes.
2
Update the ECR Repository Policy in Account B to trust the Task Execution Role from Account A.
Cross-account access is authorized on the repository level.
By default, AWS resources are isolated across accounts. The ECR repository policy must explicitly allow the Task Execution Role ARN from Account A to read image layers.

Key Concept

Configuring cross-account private ECR repository access for Amazon ECS tasks by separating Task Execution Role from Task Role permissions.
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic