Question

Difficulty: MediumIAM Policies and Roles

A developer is deploying an application on Amazon ECS using the AWS Fargate launch type. The application container needs to read messages from an Amazon SQS queue. The developer creates an IAM role with the correct SQS permissions, but the ECS task fails to start, returning an error that the task role could not be assumed. The developer inspects the trust policy currently associated with the IAM role:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the trust policy will resolve this issue and allow the ECS task to assume the role?

  1. Change the "Service" value in the "Principal" block to "ecs-tasks.amazonaws.com".Answer
  2. B
    Change the "Action" value from "sts:AssumeRole" to "sts:AssumeRoleWithWebIdentity".
  3. C
    Add "ec2.amazonaws.com" to the "Service" list under the "Principal" block.
  4. D
    Generate temporary AWS credentials using the AWS CLI and pass them to the task via environment variables.

Answer

Change the "Service" value in the "Principal" block to "ecs-tasks.amazonaws.com".
The correct option is correct because the Amazon ECS container agent requires the trust policy to specify the 'ecs-tasks.amazonaws.com' service principal. This allows ECS Fargate to assume the role and associate its permissions with the containers running in the task.

Step-by-Step Solution

1
Identify the service attempting to assume the IAM role.
The ECS task container agent needs to assume the role to run the task.
Understanding which entity is requesting the role helps determine the correct service principal.
2
Analyze the existing trust policy principal.
The principal is currently set to "ecs.amazonaws.com".
This principal is for the ECS service scheduler (used for task registration and ELB interactions), not the tasks themselves.
3
Update the trust policy service principal to allow ECS tasks to assume the role.
Change the principal to "ecs-tasks.amazonaws.com".
This allows the ECS container agent to successfully assume the role on behalf of the container.

Key Concept

IAM Trust Policies and Service Principals for ECS Tasks
Rate this question