Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is preparing to deploy a containerized financial API to Amazon ECS using the AWS Fargate launch type. The API application code utilizes the AWS SDK to decrypt sensitive transaction payloads at runtime using a customer managed key in AWS KMS. Additionally, the ECS agent must pull the API container image from a private Amazon ECR repository and send stdout/stderr logs to Amazon CloudWatch Logs. Which two IAM configuration steps must the developer perform to grant the necessary permissions? (Select TWO.)

  1. Attach a policy allowing the kms:Decrypt action to the IAM role configured as the Task Role in the task definition.Answer
  2. Attach a policy allowing the ecr:BatchGetImage and logs:PutLogEvents actions to the IAM role configured as the Task Execution Role in the task definition.Answer
  3. C
    Attach a policy allowing the kms:Decrypt action to the IAM role configured as the Task Execution Role in the task definition.
  4. D
    Modify the trust policy of the Task Role to trust the Amazon EC2 service principal (ec2.amazonaws.com) to assume the role.
  5. E
    Attach a policy allowing the logs:PutLogEvents and logs:CreateLogStream actions to the IAM role configured as the Task Role in the task definition.

Answer

The developer must attach a policy allowing the kms:Decrypt action to the Task Role, and attach a policy allowing the ecr:BatchGetImage and logs:PutLogEvents actions to the Task Execution Role.
The application code uses the AWS SDK to decrypt payloads at runtime, which requires the ECS Task Role to have permissions for the kms:Decrypt action. On the other hand, pulling the image from Amazon ECR and writing logs to CloudWatch are operations executed by the ECS agent on the host, meaning the ECS Task Execution Role must have permissions for ECR image pull actions and CloudWatch Logs stream creation/log ingestion.

Step-by-Step Solution

1
Determine the role needed for application-level AWS SDK calls.
The application code running inside the container performs decryption via the AWS SDK at runtime, which requires the ECS Task Role to have kms:Decrypt permissions.
The Task Role provides AWS credentials directly to the containerized application.
2
Determine the role needed for container agent-level tasks.
The ECS container agent needs to pull the container image from ECR and send stdout/stderr logs to CloudWatch Logs, which requires the ECS Task Execution Role to have ecr:BatchGetImage and logs:PutLogEvents permissions.
The Task Execution Role provides AWS credentials to the ECS agent running on the underlying host, enabling it to perform tasks on behalf of the container before it starts.

Key Concept

Delineation between ECS Task Role and ECS Task Execution Role
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic