Examkin

Question

Difficulty: MediumAmazon ECS and Docker Deployment

A developer is deploying a containerized API application to Amazon ECS on AWS Fargate. The container needs to send its application logs to Amazon CloudWatch Logs using the awslogs log driver. Additionally, the application code itself needs to store uploaded user profile images in an Amazon S3 bucket. How should the developer configure the IAM roles in the task definition to satisfy these requirements?

  1. A
    Associate an IAM role containing both Amazon S3 write and CloudWatch Logs write permissions as the Task Execution Role, and omit the Task Role.
  2. B
    Associate an IAM role with CloudWatch Logs write permissions as the Task Role, and associate an IAM role with Amazon S3 write permissions as the Task Execution Role.
  3. Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.Answer
  4. D
    Associate an IAM role with Amazon S3 write permissions as the Task Role, and hardcode temporary AWS credentials for CloudWatch Logs write access within the container's environment variables.

Answer

Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.
The correct answer correctly separates the roles: the Task Role provides AWS credentials to the application code running inside the container, granting access to Amazon S3. The Task Execution Role provides credentials to the Amazon ECS container agent, allowing it to write container logs to Amazon CloudWatch Logs.

Step-by-Step Solution

1
Analyze the permission requirements for the containerized application.
The application code running inside the container requires access to Amazon S3, while the container agent requires access to Amazon CloudWatch Logs for logging.
This separates the security contexts of the application code versus the infrastructure/agent management.
2
Map the application code permissions to the appropriate ECS configuration parameter.
Assign the S3 access permissions to the Task Role.
The Task Role is designed to provide credentials to the containerized application code.
3
Map the ECS agent permissions to the appropriate ECS configuration parameter.
Assign the CloudWatch Logs write permissions to the Task Execution Role.
The Task Execution Role is designed to grant permissions to the Amazon ECS container agent to pull images and write logs.

Key Concept

ECS Task Role vs. ECS Task Execution Role
Estimated Time:1m 30s
Rate this question

Topics

Amazon ECS and Docker Deployment

More questions from this topic