Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

An integration specialist is deploying a data ingestion service as a task on Amazon ECS with the EC2 launch type. The application code inside the container must read message payloads from an Amazon SQS queue and write processing logs to Amazon CloudWatch. During deployment, the ECS container agent successfully pulls the image and initializes the container, but the application throws an Access Denied error when attempting to poll the SQS queue. Which action should the developer take to resolve this issue?

  1. A
    Hardcode the AWS credentials of an IAM user with SQS permissions inside the application configuration file within the Docker container.
  2. Attach the SQS permission policy to the ECS Task Role specified by the taskRoleArn parameter, and configure its trust policy to trust ecs-tasks.amazonaws.com.Answer
  3. C
    Attach the SQS permission policy to the ECS Task Execution Role specified by the executionRoleArn parameter in the task definition.
  4. D
    Attach the SQS permission policy to the ECS Task Role, but configure the trust policy of the role to trust ec2.amazonaws.com.

Answer

Attach the SQS permission policy to the ECS Task Role specified by the taskRoleArn parameter, and configure its trust policy to trust ecs-tasks.amazonaws.com.
The containerized application code running inside the ECS task needs permissions to access SQS. These application-level permissions must be defined in an IAM role assigned as the Task Role (via the taskRoleArn parameter). Additionally, the IAM role must have a trust policy that allows the Amazon ECS tasks service (ecs-tasks.amazonaws.com) to assume the role. This permits the container itself to assume the role and make authorized AWS API calls.

Step-by-Step Solution

1
Identify which component is failing to perform the action.
The application code inside the container is failing to read from SQS, while the ECS agent is succeeding in pulling the image and sending logs.
This distinguishes between task execution tasks (agent-level) and task execution itself (application-level).
2
Select the appropriate ECS IAM role for application-level AWS API calls.
The ECS Task Role (taskRoleArn) must be configured with SQS permissions, rather than the Task Execution Role (executionRoleArn).
The Task Role provides credentials directly to the containerized application.
3
Configure the trust relationship policy for the Task Role.
Add ecs-tasks.amazonaws.com as the trusted entity in the role's trust policy.
This allows the ECS service to assume the role on behalf of the task.

Key Concept

Distinguishing between Amazon ECS Task Role and Task Execution Role configurations
Estimated Time:1m 30s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic