Examkin

Question

Difficulty: EasyAmazon ECS and Docker Deployment

A developer is configuring an Amazon ECS task definition to deploy a containerized application to AWS Fargate. The application needs a database password at startup. The password is saved as a secret in AWS Secrets Manager. The developer wants the Amazon ECS container agent to automatically retrieve the secret value and inject it as an environment variable into the container. Which configuration is required to achieve this?

  1. A
    Associate an IAM policy that allows the secretsmanager:GetSecretValue action with the ECS task role, and reference the secret in the secrets section of the container definition.
  2. B
    Reference the secret ARN in the environment section of the container definition, and configure AWS Systems Manager Parameter Store to sync the credentials.
  3. Associate an IAM policy that allows the secretsmanager:GetSecretValue action with the ECS task execution role, and reference the secret in the secrets section of the container definition.Answer
  4. D
    Hardcode AWS access keys in the application's container environment variables to allow the application code to retrieve the secret value from Secrets Manager.

Answer

Associate an IAM policy that allows the secretsmanager:GetSecretValue action with the ECS task execution role, and reference the secret in the secrets section of the container definition.
The correct option is correct because the Amazon ECS container agent is responsible for calling AWS Secrets Manager to retrieve the secret value before starting the container. To do this, the agent uses the permissions defined in the ECS task execution role. The developer must then map the secret to an environment variable inside the container definition's secrets section.

Step-by-Step Solution

1
Identify the role responsible for tasks executed by the ECS container agent.
The ECS task execution role is responsible for actions the ECS agent performs, such as pulling container images and fetching secrets.
Since the container agent is retrieving the secret and injecting it during task startup (rather than the application code itself calling Secrets Manager), the execution role must have the permission.
2
Determine the proper task definition section for injecting secrets as environment variables.
The secrets section of the container definition is used to map a secret source (like Secrets Manager) to an environment variable.
The standard environment block is only for plaintext environment variables, whereas the secrets block allows referencing secret ARNs for automatic resolution.

Key Concept

ECS Task Role vs. ECS Task Execution Role for Secret Injection
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic