A developer is deploying an application on Amazon ECS using the AWS Fargate launch type. The application container needs to read messages from an Amazon SQS queue. The developer creates an IAM role with the correct SQS permissions, but the ECS task fails to start, returning an error that the task role could not be assumed. The developer inspects the trust policy currently associated with the IAM role:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}
Which modification to the trust policy will resolve this issue and allow the ECS task to assume the role?
- Change the "Service" value in the "Principal" block to "ecs-tasks.amazonaws.com".Answer
- BChange the "Action" value from "sts:AssumeRole" to "sts:AssumeRoleWithWebIdentity".
- CAdd "ec2.amazonaws.com" to the "Service" list under the "Principal" block.
- DGenerate temporary AWS credentials using the AWS CLI and pass them to the task via environment variables.
Answer
Change the "Service" value in the "Principal" block to "ecs-tasks.amazonaws.com".
The correct option is correct because the Amazon ECS container agent requires the trust policy to specify the 'ecs-tasks.amazonaws.com' service principal. This allows ECS Fargate to assume the role and associate its permissions with the containers running in the task.
Step-by-Step Solution
Key Concept
IAM Trust Policies and Service Principals for ECS Tasks