Examkin

Question

Difficulty: EasyAmazon ECS and Docker Deployment

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application code needs to read objects from an Amazon S3 bucket.

Which of the following IAM configurations is required to allow the application code to access the S3 bucket?

  1. Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.Answer
  2. B
    Configure an IAM role with Amazon S3 read permissions and assign it as the Task Execution Role (executionRoleArn) in the ECS task definition.
  3. C
    Hardcode AWS access keys and secret access keys with S3 read permissions directly in the application code inside the Docker container.
  4. D
    Configure an IAM role with Amazon S3 read permissions, but set the trust policy principal to allow the Amazon EC2 service (ec2.amazonaws.com) to assume the role.

Answer

Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.
Configuring an IAM role with Amazon S3 read permissions and assigning it as the Task Role (taskRoleArn) in the ECS task definition is correct. The Task Role is designed to grant application code running inside the ECS container permissions to call AWS APIs.

Step-by-Step Solution

1
Identify which role is responsible for providing IAM permissions to application code running inside the container.
The Task Role (taskRoleArn) is identified as the role providing permissions directly to the application.
Differentiating between Task Role (application level) and Task Execution Role (ECS agent level) is critical for configuring correct permissions.
2
Formulate the IAM role policy for S3 access.
An IAM policy allowing S3 Read actions is created and attached to the Task Role.
This grants the application code the exact permissions needed to read objects from the S3 bucket.
3
Verify the trust policy of the IAM role.
The trust policy allows the ecs-tasks.amazonaws.com service principal to assume the role.
This ensures that Amazon ECS can successfully assign the role to the container at launch.

Key Concept

Distinction between ECS Task Role and Task Execution Role
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic