Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is configuring an Amazon ECS task definition to deploy an application on AWS Fargate. The container needs to retrieve a database password from AWS Systems Manager Parameter Store during container startup to set it as an environment variable. Once the container is running, the application code uses the AWS SDK to write application logs to an Amazon DynamoDB table. Which combination of configuration steps and IAM roles should the developer configure?

  1. Configure the ECS Task Execution Role with permissions to retrieve the parameter from Systems Manager Parameter Store, configure the ECS Task Role with permissions to perform DynamoDB operations, and configure the trust policy of both roles to allow the ecs-tasks.amazonaws.com service to assume them.Answer
  2. B
    Configure the ECS Task Execution Role with permissions to retrieve the parameter from Systems Manager Parameter Store and write to the DynamoDB table, and omit the ECS Task Role from the task definition.
  3. C
    Configure the ECS Task Execution Role with permissions to retrieve the parameter from Systems Manager Parameter Store, configure the ECS Task Role with permissions to perform DynamoDB operations, and configure the trust policy of both roles to allow the ec2.amazonaws.com service to assume them.
  4. D
    Configure the ECS Task Execution Role with permissions to retrieve the parameter from Systems Manager Parameter Store, and package static AWS access keys inside the container image to authorize DynamoDB requests made by the application code.

Answer

Configure the ECS Task Execution Role with permissions to retrieve the parameter from Systems Manager Parameter Store, configure the ECS Task Role with permissions to perform DynamoDB operations, and configure the trust policy of both roles to allow the ecs-tasks.amazonaws.com service to assume them.
The correct configuration requires assigning permissions to retrieve the Systems Manager Parameter Store parameter to the ECS Task Execution Role, because the ECS agent must fetch this value during the container setup phase. The ECS Task Role must be configured with permissions for the DynamoDB operations because this role is used by the application code running inside the container to call AWS services. Additionally, both roles require a trust relationship with the ecs-tasks.amazonaws.com service principal so that Amazon ECS can assume them.

Step-by-Step Solution

1
Identify the credentials needed at container start time versus application runtime.
The ECS agent requires permissions during startup to fetch the database password from Parameter Store (requiring the Task Execution Role), while the application code needs permissions to write logs to DynamoDB at runtime (requiring the Task Role).
Delineating between task execution and application runtime roles aligns with the principle of least privilege and container security architecture.
2
Define IAM policies for the Task Execution Role and the Task Role.
Create a policy allowing ssm:GetParameters and ssm:GetParameter for the Task Execution Role, and a policy allowing dynamodb:PutItem or dynamodb:BatchWriteItem for the Task Role.
The Task Execution Role performs operations before the container starts, whereas the Task Role handles application-level API requests.
3
Configure trust policies for both IAM roles.
Set the trust relationship service principal to ecs-tasks.amazonaws.com for both roles.
This allows the ECS service to assume the roles when launching and running the Fargate tasks.

Key Concept

ECS Task Role vs. ECS Task Execution Role
Estimated Time:1m 30s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic