Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is deploying a containerized microservice to Amazon ECS using the Amazon EC2 launch type. The microservice application code needs to write records to an Amazon DynamoDB table and publish notifications to an Amazon SNS topic. The container also needs to send its standard output and error logs to Amazon CloudWatch Logs. How should the developer configure the IAM roles in the task definition to achieve this configuration securely?

  1. A
    Assign an IAM role with DynamoDB and SNS write permissions as the Task Execution Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Role.
  2. Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Execution Role.Answer
  3. C
    Embed temporary AWS access credentials directly in the application code's initialization logic, and omit both the Task Role and Task Execution Role configurations.
  4. D
    Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and configure its IAM trust policy to trust the EC2 instance service principal (ec2.amazonaws.com) instead of the ECS tasks service principal (ecs-tasks.amazonaws.com).

Answer

Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Execution Role.
The ECS Task Role is assumed by the containers themselves to grant permissions to the application code (e.g., writing to DynamoDB and publishing to SNS). The ECS Task Execution Role is assumed by the ECS agent to perform actions on behalf of the container instance, such as pulling the container image from ECR and sending container logs to CloudWatch Logs. Configuring these roles separately adheres to the principle of least privilege.

Step-by-Step Solution

1
Identify the credentials required by the application code running inside the container.
The application code calls DynamoDB and SNS APIs, which requires permissions to be granted via the ECS Task Role.
The Task Role provides temporary credentials specifically to the processes running inside the container.
2
Identify the credentials required by the ECS agent to manage the container lifecycle.
The ECS agent needs to push container logs to CloudWatch Logs, which requires permissions to be granted via the ECS Task Execution Role.
The Task Execution Role provides permissions for the ECS container agent to perform system-level tasks like pulling images and publishing logs.
3
Verify the trust relationships for both roles.
Both roles must trust the ECS tasks service principal (ecs-tasks.amazonaws.com) to allow ECS to assume them.
Without the correct trust policy, AWS services cannot assume the roles on behalf of the ECS task.

Key Concept

Delineation between Amazon ECS Task Role and Task Execution Role
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic