An organization wants to run a microservice on Amazon ECS using the AWS Fargate launch type. The containerized application needs to publish events to an Amazon SNS topic. Additionally, the Amazon ECS container agent must download the Docker image from a private Amazon ECR repository. Which of the following configurations are required in the task definition to support this deployment? (Select TWO.)
- Specify a Task Role in the task definition that grants the containerized application permission to publish to the Amazon SNS topic.Answer
- Specify a Task Execution Role in the task definition that allows the Amazon ECS container agent to pull the image from Amazon ECR.Answer
- CSpecify a Task Role in the task definition that grants the containerized application permission to pull the container image from Amazon ECR.
- DSpecify a Task Execution Role in the task definition that allows the Amazon ECS container agent to publish to the Amazon SNS topic.
- EConfigure a Task Role that includes a trust policy allowing the Amazon EC2 service principal (ec2.amazonaws.com) to assume it.
Answer
To configure this deployment successfully, the task definition must specify a Task Role that grants the containerized application permission to publish to Amazon SNS, and a Task Execution Role that allows the Amazon ECS container agent to pull the container image from Amazon ECR.
The ECS Task Role is assumed by the containerized application itself, allowing the code to make API calls to AWS services such as publishing messages to an Amazon SNS topic. The ECS Task Execution Role is assumed by the ECS agent to perform tasks on behalf of the container registry and logging services, such as pulling the image from Amazon ECR before the container starts.
Step-by-Step Solution
Key Concept
Delineation between the ECS Task Role (used by the application container to interact with AWS services) and the ECS Task Execution Role (used by the ECS agent to perform container lifecycle tasks like pulling images or sending logs).