Examkin

Question

Difficulty: EasyIAM Policies and Roles

A developer is deploying a containerized application to Amazon ECS on AWS Fargate. The application needs to read and write items in an Amazon DynamoDB table. According to security best practices, which two steps should the developer take to configure the required permissions? (Select two.)

  1. Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal (ecs-tasks.amazonaws.com) to assume the role.Answer
  2. Attach the IAM policy containing the DynamoDB read and write permissions to the ECS Task Role.Answer
  3. C
    Attach the IAM policy containing the DynamoDB read and write permissions to the ECS Task Execution Role.
  4. D
    Modify the trust policy of the IAM role to trust the DynamoDB service principal (dynamodb.amazonaws.com).
  5. E
    Generate AWS access keys for an IAM user with DynamoDB permissions and package them as environment variables inside the Docker container image.

Answer

Create an IAM role with a trust policy that allows the Amazon ECS tasks service principal to assume the role, and attach the permissions policy to the ECS Task Role.
To secure an ECS task, the developer must use an ECS Task Role for application permissions (like DynamoDB access) and configure the trust policy to allow the ECS tasks service principal (ecs-tasks.amazonaws.com) to assume that role.

Step-by-Step Solution

1
Identify the entity that needs to make AWS API calls and the entity that needs permission to assume the role.
The application code running inside the ECS container needs to access DynamoDB. The ECS task service itself needs to assume the role to pass temporary credentials to the container.
This determines the trust policy requirements and the correct IAM role type to use.
2
Configure the trust relationship for the IAM role.
A trust policy is created allowing ecs-tasks.amazonaws.com to assume the role.
ECS tasks must be authorized to obtain temporary security credentials from AWS STS.
3
Associate the DynamoDB permissions with the application role.
The permissions policy is attached to the ECS Task Role.
The Task Role supplies credentials to the containerized application, allowing it to authenticate and authorize against the DynamoDB table.

Key Concept

IAM Task Roles for ECS tasks separation and configuration
Rate this question

Topics

IAM Policies and Roles

More questions from this topic