Examkin

Question

Difficulty: HardIAM Policies and Roles

A developer is deploying a containerized application to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The application needs to retrieve data from an Amazon DynamoDB table. The developer creates an IAM role named AppDynamoDBRole with a permissions policy that allows dynamodb:GetItem and dynamodb:Query operations, and configures the task definition's taskRoleArn parameter to point to this role. The trust policy for AppDynamoDBRole is configured as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

When the containerized application runs, it fails to authenticate with DynamoDB, and the container logs show an authorization error when attempting to assume the task role. Which of the following modifications to the configuration will resolve this issue?

  1. Change the Service value under the Principal block in the trust policy from ecs.amazonaws.com to ecs-tasks.amazonaws.com.Answer
  2. B
    Change the taskRoleArn configuration in the task definition to executionRoleArn, and attach the DynamoDB permissions to the task execution role.
  3. C
    Change the Action in the trust policy from sts:AssumeRole to sts:AssumeRoleWithWebIdentity.
  4. D
    Add the ecs:StartTask permission to the executionRoleArn to authorize the containers to initiate the assume role action.

Answer

Change the Service value under the Principal block in the trust policy from ecs.amazonaws.com to ecs-tasks.amazonaws.com.
The correct option is changing the Service principal to ecs-tasks.amazonaws.com. When configuring an ECS task definition, the taskRoleArn parameter allows containerized applications to make authorized AWS API calls. To enable this, the ECS agent must assume the designated IAM role. The trust relationship policy of the IAM role must explicitly allow the ECS tasks service principal (ecs-tasks.amazonaws.com) to perform the sts:AssumeRole action.

Step-by-Step Solution

1
Examine the trust policy of the IAM role to determine who is permitted to assume it.
The current trust policy permits the ecs.amazonaws.com service principal to assume the role.
This determines if the correct AWS service or identity has been granted trust.
2
Identify the service principal responsible for launching and executing ECS tasks.
ECS tasks run under the ecs-tasks.amazonaws.com service principal, whereas service-level control plane operations run under ecs.amazonaws.com.
The correct service principal must match the specific entity requesting the sts:AssumeRole action.
3
Update the trust policy to authorize the ecs-tasks.amazonaws.com service principal.
The ECS agent can now successfully assume the AppDynamoDBRole on behalf of the containerized application.
This establishes a valid trust relationship, resolving the authorization error.

Key Concept

IAM trust policies for Amazon ECS tasks must trust the ecs-tasks.amazonaws.com service principal to allow the ECS agent to assume the task role on behalf of containers.
Estimated Time:2m 0s
Rate this question

Topics

IAM Policies and Roles

More questions from this topic