Examkin

Question

Difficulty: HardAmazon ECS and Docker Deployment

A developer is deploying a secure microservice to Amazon ECS using the AWS Fargate launch type behind an Application Load Balancer (ALB). The container definition references a database connection string stored in AWS Systems Manager Parameter Store using the container definition `secrets` parameter. The containerized application listens on port 8080. Which combination of configurations must the developer implement to successfully route traffic to the application and allow the container to start?

  1. Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Attach an IAM policy with ssm:GetParameters permissions to the ECS task execution role.Answer
  2. B
    Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Attach an IAM policy with ssm:GetParameters permissions to the ECS task role.
  3. C
    Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Store the database connection string in AWS Secrets Manager instead, because Systems Manager Parameter Store parameters cannot be referenced in the container definition secrets parameter.
  4. D
    Configure the task definition to use the awsvpc network mode. Set the target type of the ALB target group to ip. Update the ECS task execution role's trust policy to allow the ec2.amazonaws.com service principal to assume the role.

Answer

To deploy a containerized service on AWS Fargate behind an ALB and retrieve secrets from Systems Manager Parameter Store at task startup, the developer must use the awsvpc network mode, configure the ALB target group with target type ip, and grant ssm:GetParameters permission to the ECS task execution role.
The correct option correctly identifies that the awsvpc network mode is required for AWS Fargate. When using awsvpc, the ALB target group must register targets by IP address, so the target type must be set to ip. Additionally, since the database connection string is retrieved at task startup by the ECS agent via the container definition's secrets parameter, the permissions for ssm:GetParameters must be assigned to the ECS task execution role.

Step-by-Step Solution

1
Identify the networking requirements for AWS Fargate tasks.
AWS Fargate tasks must use the awsvpc network mode.
Fargate does not support other network modes like bridge or host.
2
Determine the correct ALB target group registration type for the awsvpc network mode.
The target group type must be configured as ip.
Because tasks using the awsvpc network mode are allocated their own Elastic Network Interfaces (ENIs) with private IP addresses, they must be registered with the ALB by IP address rather than instance ID.
3
Identify the correct IAM role required for the ECS container agent to retrieve secrets during task initialization.
The ssm:GetParameters permission must be attached to the ECS task execution role.
The task execution role is used by the Amazon ECS container agent to pull images and retrieve secrets from Parameter Store or Secrets Manager before the containers start. The task role is used by the application code itself once running.

Key Concept

Differentiating between ECS Task Role and Task Execution Role, and configuring networking for Fargate behind an Application Load Balancer.
Estimated Time:2m 30s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic