Examkin

Question

Difficulty: MediumResolving IAM and Authorization Failures

A developer is deploying a containerized application to Amazon ECS on AWS Fargate. The application code is designed to use the AWS SDK to retrieve database credentials from AWS Secrets Manager at startup.

The ECS task definition is configured with the following parameters:
- taskRoleArn set to ecs-app-task-role
- executionRoleArn set to ecs-app-execution-role

The developer attached an IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-execution-role. However, when the container starts, the application throws an AccessDeniedException when executing the GetSecretValue SDK call.

What should the developer do to resolve this authorization failure?

  1. A
    Update the trust policy of the ecs-app-execution-role to allow the Secrets Manager service principal (secretsmanager.amazonaws.com) to assume the role.
  2. Attach the IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-task-role.Answer
  3. C
    Configure the container application to retrieve credentials directly from the ECS Task Execution Role metadata endpoint.
  4. D
    Hardcode the AWS access key and secret key of a dedicated IAM user with Secrets Manager access in the application's SDK client initialization.

Answer

Attach the IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-task-role.
The correct action is to attach the permission policy allowing secretsmanager:GetSecretValue to the ECS Task Role (ecs-app-task-role). When an application runs inside an ECS container and makes calls to AWS services using the AWS SDK, the SDK retrieves credentials from the task's credential provider, which are associated with the ECS Task Role. The ECS Task Execution Role is only used by the ECS container agent to perform lifecycle tasks on behalf of the container, such as pulling container images from Amazon ECR or writing logs to Amazon CloudWatch.

Step-by-Step Solution

1
Analyze the source of the API call.
The application code itself is using the AWS SDK at runtime to execute the GetSecretValue action.
This determines whether the task role or the execution role needs the permission.
2
Differentiate between the ECS Task Role and the ECS Task Execution Role.
The Task Role (taskRoleArn) provides permissions for the application container's SDK calls. The Task Execution Role (executionRoleArn) provides permissions for the ECS agent (e.g., pulling images, logging, or injecting secrets into environment variables).
Correctly routing permissions requires understanding which IAM entity is executing the action.
3
Reassign the permission policy.
Move or attach the IAM policy allowing secretsmanager:GetSecretValue to the ecs-app-task-role.
This resolves the authorization failure because the SDK client will assume the task role and successfully authenticate.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role for resolving runtime SDK authorization failures.
Rate this question

Topics

Resolving IAM and Authorization Failures

More questions from this topic