Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

An application team is deploying a containerized API to Amazon ECS using the AWS Fargate launch type. The application code needs to retrieve operational parameters from Amazon DynamoDB during runtime. Additionally, the ECS agent must retrieve database credentials from AWS Secrets Manager to configure the application's environment variables before the container starts. Which configuration will allow the application to start and run successfully with the least privilege?

  1. A
    Configure the ECS Task Execution Role with permissions for both dynamodb:GetItem and secretsmanager:GetSecretValue, leaving the Task Role empty.
  2. B
    Configure the ECS Task Role with permissions for dynamodb:GetItem and the Task Execution Role with permissions for secretsmanager:GetSecretValue, and configure the trust policy of both roles to trust the ecs.amazonaws.com service principal.
  3. Configure the ECS Task Role with permissions for dynamodb:GetItem and the ECS Task Execution Role with permissions for secretsmanager:GetSecretValue, and configure the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal.Answer
  4. D
    Configure the ECS Task Execution Role to read credentials from AWS Secrets Manager, and hardcode the AWS access keys in the application's initialization code to access the DynamoDB table.

Answer

Configure the ECS Task Role with permissions for dynamodb:GetItem, the ECS Task Execution Role with permissions for secretsmanager:GetSecretValue, and configure both roles to trust the ecs-tasks.amazonaws.com service principal.
The correct configuration assigns DynamoDB permissions to the ECS Task Role and Secrets Manager permissions to the ECS Task Execution Role, while setting the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal. This separates responsibilities: the Task Execution Role allows the ECS agent to prepare the container environment (including resolving environment variables from Secrets Manager), while the Task Role gives the running containerized application the temporary AWS credentials it needs to perform DynamoDB API operations.

Step-by-Step Solution

1
Identify the role needed for application code runtime permissions.
The ECS Task Role is selected for DynamoDB operations.
The application code runs inside the container and requires access to DynamoDB during its execution lifecycle.
2
Identify the role needed for container agent startup and configuration permissions.
The ECS Task Execution Role is selected to fetch secrets from AWS Secrets Manager.
The ECS container agent runs outside the user container and must retrieve credentials to expose them as environment variables before the container starts.
3
Verify the correct IAM trust policy service principal.
Set the trust policy service principal to ecs-tasks.amazonaws.com for both roles.
ECS tasks require the task-specific service principal to assume the execution and task roles, rather than the core ECS service principal.

Key Concept

Amazon ECS IAM Roles Separation (Task Role vs Task Execution Role)
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic