Examkin

Amazon ECS and Docker Deployment

45 questions

All types45Multiple choice25Multiple select20
Question 1Question →

A company is migrating a containerized web application to run on Amazon ECS using the Amazon EC2 launch type. Multiple instances of the application task must run on each container instance, and the tasks are configured to use the bridge network mode. The application code requires access to a database password stored in AWS Secrets Manager and must perform read operations on an Amazon DynamoDB table. Which two configurations are required to support this deployment?

Select all that apply

Show answer & explanation

Answer: Set the container port to 80 and the host port to 0 (or leave it blank) in the task definition port mapping.; Configure the task definition's Task Role (taskRoleArn) with the IAM policies required to access the Amazon DynamoDB table and AWS Secrets Manager.

Answer

Configure dynamic port mapping by setting the host port to 0 or leaving it blank, and assign the required IAM policies to the ECS Task Role (taskRoleArn) with a trust policy for ecs-tasks.amazonaws.com.
To support running multiple instances of the container on a single EC2 host using the bridge network mode, dynamic host port mapping is required. This is achieved by setting the host port to 0 or leaving it blank in the task definition port mapping, which allows the ECS agent to automatically map the container port to a random ephemeral port on the host. Furthermore, the application container requires AWS credentials at runtime to query the DynamoDB table and fetch secrets from Secrets Manager. These application-level permissions must be defined in an IAM role assigned to the taskRoleArn (Task Role) parameter of the task definition.

Step-by-Step Solution

1
Configure the port mapping in the task definition for bridge network mode with the host port set to 0 or left blank.
Enables dynamic port mapping, letting the ECS agent bind the container's port to a random host port.
Allows multiple task instances to run on the same EC2 instance without port conflicts.
2
Create an IAM role that trusts the ecs-tasks.amazonaws.com service principal and attach permission policies for DynamoDB and Secrets Manager.
Creates a role that ECS tasks can assume to perform API operations on AWS services.
Secures application credentials by avoiding hardcoded values and granting access via temporary credentials.
3
Assign this role to the taskRoleArn parameter in the ECS task definition.
Ensures the containerized application executes with the permissions defined in the IAM role.
Maintains the separation of concerns by assigning application access to the Task Role rather than the Task Execution Role.

Key Concept

ECS Task Role vs Task Execution Role and Bridge Network Mode Port Mapping
Estimated Time:2m 0s
Question 2Question →

A developer is deploying a containerized microservice to Amazon ECS using the AWS Fargate launch type. The application code inside the container must read messages from an Amazon SQS queue, decrypt the message payloads using an AWS KMS key, and write results to an Amazon DynamoDB table. Additionally, the task definition specifies that the database password, stored as a secure string in Systems Manager Parameter Store, should be injected as an environment variable at startup. The container image is pulled from a private Amazon ECR repository.

Which of the following configurations are required to establish the correct IAM permissions for this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS Task Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the application code to read from the SQS queue, write to the DynamoDB table, and decrypt SQS payloads using the KMS key.; Configure the ECS Task Execution Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the container agent to pull from Amazon ECR, write to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store.

Answer

Configure the ECS Task Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the application code to read from the SQS queue, write to the DynamoDB table, and decrypt SQS payloads using the KMS key; and configure the ECS Task Execution Role with a trust policy for the ecs-tasks.amazonaws.com service principal, and attach a policy that allows the container agent to pull from Amazon ECR, write to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store.
To establish the correct IAM permissions, the ECS Task Role and the ECS Task Execution Role must be configured with the appropriate trust policies and permissions. The ECS Task Role is used by the application code running inside the container; therefore, it must be granted permissions to read from the SQS queue, write to the DynamoDB table, and decrypt the SQS payloads using the KMS key. The ECS Task Execution Role is used by the ECS container agent to perform actions on behalf of the task before the container starts; therefore, it must be granted permissions to pull the container image from the private Amazon ECR repository, write log streams to Amazon CloudWatch Logs, and retrieve the database password from Systems Manager Parameter Store to inject it as an environment variable.

Step-by-Step Solution

1
Distinguish between infrastructure actions (ECS agent) and application actions (running code).
The application code reads from SQS, decrypts payloads, and writes to DynamoDB. The ECS agent pulls the Docker image, handles container logs, and pulls secrets to inject as environment variables at startup.
This separation determines whether a permission belongs to the Task Role or the Task Execution Role.
2
Assign the application permissions to the ECS Task Role and configure its trust policy.
Create an IAM role that trusts 'ecs-tasks.amazonaws.com' and attach a policy with permissions for SQS, DynamoDB, and KMS decryption.
The containerized application assumes this role at runtime to authenticate its AWS SDK client requests.
3
Assign the infrastructure/agent permissions to the ECS Task Execution Role and configure its trust policy.
Create an IAM role that trusts 'ecs-tasks.amazonaws.com' and attach a policy with permissions for ECR pulling, CloudWatch Logs writing, and Systems Manager Parameter Store reading.
The ECS container agent uses this role during container provisioning and startup phases.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role in AWS Fargate
Estimated Time:2m 30s
Question 3Question →

A developer is configuring an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application is configured to stream logs to Amazon CloudWatch using the `awslogs` log driver, and it retrieves a database password from AWS Secrets Manager by referencing the secret in the container definition's environment variables. Inside the container, the application code uses the AWS SDK to write processed reports to an Amazon S3 bucket.

Which of the following IAM configurations must the developer apply to allow the task to run and successfully perform all of these operations?

Show answer & explanation

Answer: Attach an IAM policy with s3:PutObject permissions to the ECS Task Role, and attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Execution Role. Configure the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal.

Answer

Attach an IAM policy with s3:PutObject permissions to the ECS Task Role, and attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Execution Role. Configure the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal.
The correct answer properly separates the runtime application permissions (S3 upload) into the Task Role and the container agent's operational permissions (CloudWatch logs and Secrets Manager retrieval) into the Task Execution Role. It also correctly specifies the ecs-tasks.amazonaws.com service principal in the trust policy of both roles to allow Amazon ECS to assume them.

Step-by-Step Solution

1
Differentiate between the permissions needed by the application runtime and those needed by the ECS agent.
The application code needs S3 permissions, which requires the ECS Task Role. The ECS container agent needs CloudWatch Logs and Secrets Manager permissions to set up the container, which requires the ECS Task Execution Role.
Splitting these permissions correctly conforms to the principle of least privilege and allows both the agent and application to execute successfully.
2
Verify the correct trust relationship service principal for ECS task roles.
Both roles must specify the ecs-tasks.amazonaws.com service principal in their trust policy.
This allows the ECS service to assume these roles on behalf of the tasks running on AWS Fargate.

Key Concept

Differentiating between the ECS Task Role and the ECS Task Execution Role is critical when deploying containerized applications. The Task Role is assumed by the application code inside the container to make AWS API calls, whereas the Task Execution Role is assumed by the Amazon ECS container agent to perform setup operations like pulling images, writing logs to CloudWatch, and reading environment variables from Systems Manager Parameter Store or Secrets Manager.
Question 4Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application is packaged in a Docker image stored in a private Docker Hub repository. During task initialization, the Amazon ECS agent must pull this image using credentials stored in AWS Secrets Manager. Once running, the application code must publish messages to an Amazon SQS queue. Which combination of IAM configurations should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach a policy to the ECS task execution role that allows the secretsmanager:GetSecretValue action on the secret containing the private registry credentials.; Attach a policy to the ECS task role that allows the sqs:SendMessage action on the Amazon SQS queue.

Answer

To configure this setup correctly, the developer must attach the secretsmanager:GetSecretValue permission to the ECS task execution role to allow the ECS agent to retrieve the private registry credentials, and attach the sqs:SendMessage permission to the ECS task role to allow the application code to write to the SQS queue.
The correct configurations involve assigning the registry credentials access to the ECS task execution role and assigning SQS permissions to the ECS task role. The ECS task execution role is assumed by the ECS agent to perform actions such as pulling the container image and pulling secrets from Secrets Manager. The ECS task role is assumed by the application running inside the container, granting it permissions to interact with AWS resources like SQS.

Step-by-Step Solution

1
Determine the role required for container image pull authentication.
The ECS container agent handles pulling the image from the private registry during task initialization, which requires accessing the secret credentials. This requires the ECS Task Execution Role.
Permissions needed by the ECS daemon/agent (such as pulling images and reading secrets to start containers) must be defined in the Task Execution Role.
2
Determine the role required for SQS message publishing.
The application code running inside the container performs the SQS operations once the container starts. This requires the ECS Task Role.
Permissions needed by the containerized application code itself (such as interacting with AWS APIs like DynamoDB, S3, or SQS) must be defined in the Task Role.
3
Select the two correct configuration steps.
Assign secrets retrieval to the task execution role, and assign SQS send message permission to the task role.
This correctly maps permissions based on which entity (the ECS agent vs. the application code) performs each action.

Key Concept

ECS Task Role vs. Task Execution Role
Question 5Question →

A developer is configuring an Amazon ECS task definition to deploy a microservice on AWS Fargate. The microservice retrieves database credentials from AWS Secrets Manager by referencing the secret's ARN in the container definition's `secrets` parameter. Additionally, the application code inside the container reads messages from an Amazon SQS queue. The container uses the `awslogs` log driver to send standard output logs to Amazon CloudWatch Logs. Which configuration of IAM roles correctly implements the principle of least privilege for this deployment?

Show answer & explanation

Answer: Configure the Task Execution Role with permissions to retrieve the database credentials from AWS Secrets Manager and write to Amazon CloudWatch Logs. Configure the Task Role with permissions to receive and delete messages from the Amazon SQS queue. Ensure both roles trust the ecs-tasks.amazonaws.com service principal.

Answer

Configure the Task Execution Role with permissions to retrieve the database credentials from AWS Secrets Manager and write to Amazon CloudWatch Logs, configure the Task Role with permissions to receive and delete messages from the Amazon SQS queue, and ensure both roles trust the ecs-tasks.amazonaws.com service principal.
The Task Execution Role grants the ECS agent permissions to pull container images, write logs to CloudWatch using the awslogs log driver, and retrieve secrets from AWS Secrets Manager. The Task Role grants permissions directly to the application running inside the container, allowing it to communicate with Amazon SQS. Both roles must have a trust relationship allowing the ecs-tasks.amazonaws.com service principal to assume them.

Step-by-Step Solution

1
Identify the actions performed by the Amazon ECS container agent during container initialization.
The agent pulls the container image, retrieves the database secret from AWS Secrets Manager to inject as an environment variable, and configures the awslogs log driver to stream stdout/stderr logs to CloudWatch Logs.
Actions performed by the ECS agent before the application runs must be authorized via the Task Execution Role.
2
Identify the actions performed by the application code running inside the container.
The application code makes calls using the AWS SDK to receive and delete messages from the Amazon SQS queue.
Actions performed by the application code itself must be authorized via the Task Role.
3
Determine the correct trust policy for the IAM roles to allow ECS to assume them.
The trust policy must allow the ecs-tasks.amazonaws.com service principal to assume the roles.
The ecs-tasks.amazonaws.com service principal is required for task-level execution and task role assumption, whereas ecs.amazonaws.com is used for the ECS service level operations.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role, including proper IAM trust policies.
Estimated Time:2m 30s
Question 6Question →

A developer is deploying a containerized microservice to Amazon ECS using the Amazon EC2 launch type. The microservice application code needs to write records to an Amazon DynamoDB table and publish notifications to an Amazon SNS topic. The container also needs to send its standard output and error logs to Amazon CloudWatch Logs. How should the developer configure the IAM roles in the task definition to achieve this configuration securely?

Show answer & explanation

Answer: Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Execution Role.

Answer

Assign an IAM role with DynamoDB and SNS write permissions as the Task Role, and assign an IAM role with CloudWatch Logs write permissions as the Task Execution Role.
The ECS Task Role is assumed by the containers themselves to grant permissions to the application code (e.g., writing to DynamoDB and publishing to SNS). The ECS Task Execution Role is assumed by the ECS agent to perform actions on behalf of the container instance, such as pulling the container image from ECR and sending container logs to CloudWatch Logs. Configuring these roles separately adheres to the principle of least privilege.

Step-by-Step Solution

1
Identify the credentials required by the application code running inside the container.
The application code calls DynamoDB and SNS APIs, which requires permissions to be granted via the ECS Task Role.
The Task Role provides temporary credentials specifically to the processes running inside the container.
2
Identify the credentials required by the ECS agent to manage the container lifecycle.
The ECS agent needs to push container logs to CloudWatch Logs, which requires permissions to be granted via the ECS Task Execution Role.
The Task Execution Role provides permissions for the ECS container agent to perform system-level tasks like pulling images and publishing logs.
3
Verify the trust relationships for both roles.
Both roles must trust the ECS tasks service principal (ecs-tasks.amazonaws.com) to allow ECS to assume them.
Without the correct trust policy, AWS services cannot assume the roles on behalf of the ECS task.

Key Concept

Delineation between Amazon ECS Task Role and Task Execution Role
Question 7Question →

A developer is creating an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application needs to pull its container image from a private Amazon ECR repository in the same AWS account. Additionally, the application code itself must make calls to the Amazon Translate API to translate user reviews at runtime. Which configuration of IAM roles will allow the task to pull the image and run successfully with the least privilege?

Show answer & explanation

Answer: Specify an IAM role in the taskExecutionRoleArn parameter that allows the Amazon ECS agent to pull the image from Amazon ECR, and specify a different IAM role in the taskRoleArn parameter that allows the containerized application to call the Amazon Translate API.

Answer

Specify an IAM role in the taskExecutionRoleArn parameter that allows the Amazon ECS agent to pull the image from Amazon ECR, and specify a different IAM role in the taskRoleArn parameter that allows the containerized application to call the Amazon Translate API.
The correct configuration uses the Task Execution Role (taskExecutionRoleArn) to grant the Amazon ECS agent permissions to pull the image from Amazon ECR, and uses the Task Role (taskRoleArn) to grant the application running inside the container permission to call the Amazon Translate API. This respects the least-privilege model and aligns with how ECS handles agent-level versus container-level permissions.

Step-by-Step Solution

1
Determine the resource access required by the ECS agent versus the application container.
The Amazon ECS agent requires access to Amazon ECR to pull the image. The application code inside the container requires access to Amazon Translate.
The container infrastructure must pull the container image before startup. Once the container is running, the application code makes outgoing calls to other AWS APIs.
2
Map the access requirements to the correct ECS task definition role parameters.
Assign ECR access to the Task Execution Role (taskExecutionRoleArn) and Translate access to the Task Role (taskRoleArn).
The Task Execution Role is for ECS agent infrastructure activities (ECR pull, CloudWatch log streams). The Task Role is for the containerized application's own SDK calls.
3
Verify that the trust relationships are configured correctly and that credentials are secure.
Ensure both roles trust the 'ecs-tasks.amazonaws.com' service principal, avoiding the use of hardcoded IAM user keys.
ECS tasks must be allowed to assume these roles. Utilizing the Task Role provides automated credential rotation, ensuring security.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role
Question 8Question →

A developer is configuring an Amazon ECS task definition to deploy a backend service to AWS Fargate. The service requires sensitive database credentials stored in AWS Systems Manager Parameter Store to be injected as environment variables when the container starts. Additionally, the service logs must be sent directly to Amazon CloudWatch Logs. Which TWO configurations must the developer implement to meet these requirements?

Select all that apply

Show answer & explanation

Answer: Add the ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role.; In the task definition, define the secrets parameter inside the container definition referencing the Parameter Store parameter ARNs, and configure the logConfiguration parameter to use the awslogs log driver.

Answer

The correct configurations are: adding ssm:GetParameters and logs:PutLogEvents permissions to the ECS Task Execution Role, and defining the secrets parameter referencing the Parameter Store ARNs along with the awslogs log driver in the container definition.
The correct configuration requires adding the necessary permissions to the ECS Task Execution Role, as this is the IAM role used by the ECS container agent to call AWS APIs (like SSM to pull parameters and CloudWatch to write logs) before the containerized application runs. Additionally, the task definition must use the 'secrets' parameter to declare the environment variables mapped to SSM parameters, and configure 'logConfiguration' with the 'awslogs' driver to natively forward standard output and standard error stream logs.

Step-by-Step Solution

1
Determine which role requires permissions for startup operations.
The ECS Task Execution Role is identified because the ECS container agent (not the application code) is responsible for pulling secrets at startup and routing logs.
Understanding the division of responsibilities between the Task Execution Role (agent permissions) and the Task Role (application permissions) is key.
2
Identify the proper configuration syntax in the task definition for secrets and logging.
The 'secrets' parameter is used to map Parameter Store values to environment variables, and the 'logConfiguration' with 'awslogs' driver is used for CloudWatch Logs.
This matches the native ECS integration requirements for secure environment variables and log routing.
3
Grant the necessary IAM permissions to the correct role.
Attach an IAM policy with ssm:GetParameters and logs:PutLogEvents (along with logs:CreateLogStream) to the Task Execution Role.
The ECS agent requires these specific permissions to retrieve the parameters and write log data to CloudWatch.

Key Concept

ECS Task Role vs. Task Execution Role & ECS Secret Injection
Estimated Time:2m 0s
Question 9Question →

A developer is deploying a containerized microservice to Amazon ECS using the AWS Fargate launch type. The application requires sensitive database credentials to be injected into the container as environment variables at startup from AWS Systems Manager Parameter Store. Additionally, the application must send its container logs to Amazon CloudWatch Logs using the awslogs log driver. Which configuration steps must the developer perform to establish the required IAM roles and permissions for this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Configure the ECS task execution role with permissions to read the SSM parameters, decrypt the values using AWS KMS, and create/write log streams in CloudWatch Logs.; Configure the trust policy of the ECS task execution role to allow the ecs-tasks.amazonaws.com service principal to assume the role.

Answer

Configure the ECS task execution role with permissions to read the SSM parameters, decrypt the values using AWS KMS, and create/write log streams in CloudWatch Logs, and configure the trust policy of the ECS task execution role to allow the ecs-tasks.amazonaws.com service principal to assume the role.
The correct options state that the ECS task execution role must be configured with permissions to access SSM Parameter Store, decrypt the secrets using KMS, and write logs to CloudWatch, and that the trust policy must allow ecs-tasks.amazonaws.com to assume the role. The ECS container agent runs outside the application container to set up logs and pull secrets, meaning it relies on the task execution role, which must trust the ECS service principal.

Step-by-Step Solution

1
Identify the agent responsible for pulling secrets and setting up logging.
The ECS container agent (not the application code) performs these pre-startup actions, which means the ECS task execution role is required instead of the ECS task role.
Correctly segregating container initialization permissions from application runtime permissions is required by ECS.
2
Grant specific resource access permissions to the task execution role.
The task execution role receives permissions to read SSM parameters, decrypt KMS keys, and create/write logs in CloudWatch.
This enables the ECS agent to retrieve credentials from Parameter Store and direct container logs to CloudWatch.
3
Configure the trust relationship for the task execution role.
The role's trust policy is updated to allow the ecs-tasks.amazonaws.com service principal to assume the role.
ECS tasks cannot assume IAM roles unless the ECS service principal is explicitly trusted.

Key Concept

Differentiating between the ECS Task Role and the ECS Task Execution Role, and configuring the correct trust relationships and policies.
Estimated Time:1m 30s
Question 10Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application code needs to read objects from an Amazon S3 bucket.

Which of the following IAM configurations is required to allow the application code to access the S3 bucket?

Show answer & explanation

Answer: Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.

Answer

Configure an IAM role with Amazon S3 read permissions and assign it as the Task Role (taskRoleArn) in the ECS task definition.
Configuring an IAM role with Amazon S3 read permissions and assigning it as the Task Role (taskRoleArn) in the ECS task definition is correct. The Task Role is designed to grant application code running inside the ECS container permissions to call AWS APIs.

Step-by-Step Solution

1
Identify which role is responsible for providing IAM permissions to application code running inside the container.
The Task Role (taskRoleArn) is identified as the role providing permissions directly to the application.
Differentiating between Task Role (application level) and Task Execution Role (ECS agent level) is critical for configuring correct permissions.
2
Formulate the IAM role policy for S3 access.
An IAM policy allowing S3 Read actions is created and attached to the Task Role.
This grants the application code the exact permissions needed to read objects from the S3 bucket.
3
Verify the trust policy of the IAM role.
The trust policy allows the ecs-tasks.amazonaws.com service principal to assume the role.
This ensures that Amazon ECS can successfully assign the role to the container at launch.

Key Concept

Distinction between ECS Task Role and Task Execution Role
Question 11Question →

A development team is migrating a legacy backend API to run on Amazon ECS with the AWS Fargate launch type. The deployment process requires the Amazon ECS agent to authenticate with a private Amazon ECR registry to retrieve the Docker image and to configure log streams in Amazon CloudWatch. Which of the following IAM configuration steps are required to enable this setup? (Select two.)

Select all that apply

Show answer & explanation

Answer: Assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch.; Configure the trust policy of the Task Execution Role to permit the Amazon ECS Tasks service principal (ecs-tasks.amazonaws.com) to assume the role.

Answer

To successfully deploy the tasks on Fargate, you must assign an ECS Task Execution Role containing ECR pull and CloudWatch logging permissions, and update its trust policy to allow the ecs-tasks.amazonaws.com service principal to assume it.
The correct options state that we must assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch, and configure the trust policy of this role to permit the Amazon ECS Tasks service principal to assume it. This ensures that the ECS agent, running outside the container space, has the necessary permissions to retrieve the container image and initialize logging.

Step-by-Step Solution

1
Identify the entity performing infrastructure actions (image pull and log creation).
The Amazon ECS container agent runs before the application starts, requiring these permissions via the Task Execution Role.
Differentiating between task execution permissions (infra setup) and application permissions (runtime code) is necessary to choose the correct IAM role.
2
Configure the trust relationship on the Task Execution Role.
Trust policy is updated to allow the 'ecs-tasks.amazonaws.com' service principal to call AssumeRole.
Without the correct trust policy, AWS services cannot assume the IAM role to retrieve temporary security credentials.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role, and configuring appropriate trust relationships.
Estimated Time:1m 0s
Question 12Question →

A developer is creating an Amazon ECS task definition to deploy a containerized application to AWS Fargate. The container needs to pull its image from Amazon ECR, write container logs to Amazon CloudWatch Logs, and query an Amazon DynamoDB table. Which two configurations must the developer specify in the task definition to meet these requirements?

Select all that apply

Show answer & explanation

Answer: A task execution role that grants permissions to pull the container image from Amazon ECR and write logs to Amazon CloudWatch Logs; A task role that grants permissions to the application code running inside the container to query the Amazon DynamoDB table

Answer

The developer must specify a task execution role to grant ECR and CloudWatch access to the ECS agent, and a task role to grant DynamoDB access to the application code.
The correct choices specify a task execution role to grant the ECS agent permissions to pull ECR images and write CloudWatch logs, and a task role to grant the application code permissions to query DynamoDB.

Step-by-Step Solution

1
Identify the permissions needed for the ECS container agent to pull the Docker image and configure logging.
These infrastructure lifecycle actions are executed by the ECS agent, requiring the Task Execution Role.
The Task Execution Role provides the necessary permissions for the container agent itself before the application container starts.
2
Identify the permissions needed for the application code itself to interact with Amazon DynamoDB.
This business logic is executed inside the application container, requiring the Task Role.
The Task Role assigns permissions directly to the application container so the code can query AWS resources using SDKs.

Key Concept

Amazon ECS Task IAM Roles
Estimated Time:1m 0s
Question 13Question →

A developer is configuring an Amazon ECS task definition to deploy a containerized application to AWS Fargate. The application needs a database password at startup. The password is saved as a secret in AWS Secrets Manager. The developer wants the Amazon ECS container agent to automatically retrieve the secret value and inject it as an environment variable into the container. Which configuration is required to achieve this?

Show answer & explanation

Answer: Associate an IAM policy that allows the secretsmanager:GetSecretValue action with the ECS task execution role, and reference the secret in the secrets section of the container definition.

Answer

Associate an IAM policy that allows the secretsmanager:GetSecretValue action with the ECS task execution role, and reference the secret in the secrets section of the container definition.
The correct option is correct because the Amazon ECS container agent is responsible for calling AWS Secrets Manager to retrieve the secret value before starting the container. To do this, the agent uses the permissions defined in the ECS task execution role. The developer must then map the secret to an environment variable inside the container definition's secrets section.

Step-by-Step Solution

1
Identify the role responsible for tasks executed by the ECS container agent.
The ECS task execution role is responsible for actions the ECS agent performs, such as pulling container images and fetching secrets.
Since the container agent is retrieving the secret and injecting it during task startup (rather than the application code itself calling Secrets Manager), the execution role must have the permission.
2
Determine the proper task definition section for injecting secrets as environment variables.
The secrets section of the container definition is used to map a secret source (like Secrets Manager) to an environment variable.
The standard environment block is only for plaintext environment variables, whereas the secrets block allows referencing secret ARNs for automatic resolution.

Key Concept

ECS Task Role vs. ECS Task Execution Role for Secret Injection
Question 14Question →

A developer is configuring a task definition to run a microservice on Amazon ECS using the AWS Fargate launch type. The microservice application code needs to send messages to an Amazon SQS queue. How should the developer grant the application code the required SQS permissions?

Show answer & explanation

Answer: Assign the permissions to the IAM role specified in the taskRoleArn parameter of the task definition.

Answer

Assign the permissions to the IAM role specified in the taskRoleArn parameter of the task definition.
The correct option is the one specifying the use of the taskRoleArn parameter. When deploying containers on Amazon ECS, the Task Role (taskRoleArn) grants the containerized application permissions to make API requests to other AWS services like Amazon SQS. The AWS SDK inside the container automatically retrieves temporary credentials associated with this role.

Step-by-Step Solution

1
Identify the resource requiring credentials.
The application code running inside the ECS container needs to interact with Amazon SQS.
This determines whether the task agent permissions or the application permissions are needed.
2
Distinguish between ECS Task Role and ECS Task Execution Role.
The Task Role (taskRoleArn) is designed for the application inside the container, whereas the Task Execution Role (executionRoleArn) is for the ECS agent itself.
Choosing the correct role ensures the application can retrieve temporary credentials for SQS.
3
Select the appropriate parameter in the task definition.
Apply the IAM policy with SQS write permissions to the IAM role specified by taskRoleArn.
This secures the containerized application without exposing static credentials or misconfiguring agent roles.

Key Concept

ECS Task Role vs. ECS Task Execution Role
Estimated Time:45s
Question 15Question →

An organization wants to run a microservice on Amazon ECS using the AWS Fargate launch type. The containerized application needs to publish events to an Amazon SNS topic. Additionally, the Amazon ECS container agent must download the Docker image from a private Amazon ECR repository. Which of the following configurations are required in the task definition to support this deployment? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Specify a Task Role in the task definition that grants the containerized application permission to publish to the Amazon SNS topic.; Specify a Task Execution Role in the task definition that allows the Amazon ECS container agent to pull the image from Amazon ECR.

Answer

To configure this deployment successfully, the task definition must specify a Task Role that grants the containerized application permission to publish to Amazon SNS, and a Task Execution Role that allows the Amazon ECS container agent to pull the container image from Amazon ECR.
The ECS Task Role is assumed by the containerized application itself, allowing the code to make API calls to AWS services such as publishing messages to an Amazon SNS topic. The ECS Task Execution Role is assumed by the ECS agent to perform tasks on behalf of the container registry and logging services, such as pulling the image from Amazon ECR before the container starts.

Step-by-Step Solution

1
Identify the permissions needed by the application code running inside the container (publishing to Amazon SNS).
Determine that these application-level permissions must be associated with the ECS Task Role.
The Task Role is used by the containerized application to access AWS resources after the container starts.
2
Identify the permissions needed by the Amazon ECS container agent (pulling the Docker image from Amazon ECR).
Determine that these agent-level permissions must be associated with the ECS Task Execution Role.
The Task Execution Role is used by the ECS container agent to execute tasks like pulling images and writing logs before the container code runs.

Key Concept

Delineation between the ECS Task Role (used by the application container to interact with AWS services) and the ECS Task Execution Role (used by the ECS agent to perform container lifecycle tasks like pulling images or sending logs).
Question 16Question →

A web application is deployed as a Docker container on Amazon ECS using the AWS Fargate launch type. The application's Go code utilizes the AWS SDK to retrieve configuration files from an Amazon S3 bucket. Which IAM role must be configured with Amazon S3 read permissions to allow the application code to access the bucket?

Show answer & explanation

Answer: The ECS Task Role

Answer

The ECS Task Role
The ECS Task Role is the IAM role assumed by the container itself. AWS SDKs running inside the container retrieve credentials from this role automatically, allowing the application code to interact with AWS services like Amazon S3.

Step-by-Step Solution

1
Identify the entity requiring access to the Amazon S3 bucket.
The application code running inside the container requires access to read S3 objects.
This determines whether we need a role for the application code or a role for the ECS infrastructure agent.
2
Select the ECS task parameter designed for application-level AWS API permissions.
The ECS Task Role (taskRoleArn) provides temporary credentials directly to the containerized application.
The Task Execution Role is for ECS agent tasks (like image pulls and logging), whereas the Task Role is for application code tasks.

Key Concept

ECS Task Role vs Task Execution Role
Estimated Time:45s
Question 17Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application requires a database connection string that is stored as a secure string in Systems Manager Parameter Store. The developer wants the connection string to be automatically injected as a container environment variable at startup without modifying the application code to retrieve it. Which configuration will meet these requirements?

Show answer & explanation

Answer: Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Execution Role.

Answer

Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Execution Role.
Referencing the Systems Manager Parameter Store parameter ARN in the `secrets` section of the container definition tells the ECS agent to retrieve the parameter and inject it as an environment variable at container startup. Because this action is performed by the ECS container agent before the containerized application is running, the ECS Task Execution Role must contain the `ssm:GetParameters` permission.

Step-by-Step Solution

1
Identify the component responsible for retrieving the secret at container startup.
The Amazon ECS container agent is responsible for fetching the secret and injecting it as an environment variable before the application starts.
Since the application code itself is not retrieving the secret via the SDK, the ECS agent needs the direct permission.
2
Select the correct IAM role for the ECS container agent permissions.
The Task Execution Role must be used.
The Task Execution Role is utilized by the ECS agent to perform actions on behalf of the task (such as pulling container images, writing logs, and retrieving secrets), whereas the Task Role is for the application container itself.
3
Configure the task definition container definition.
Map the environment variable in the `secrets` array pointing to the SSM Parameter Store parameter ARN, and ensure the trust policy of the Task Execution Role allows the `ecs-tasks.amazonaws.com` service to assume it.
This binds the parameter to the environment variable securely and allows the ECS service to successfully assume the execution role.

Key Concept

Delineation between ECS Task Role and ECS Task Execution Role for secret management
Estimated Time:1m 30s
Question 18Question →

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The ECS task needs to pull the container image from a private Amazon ECR repository and send container logs to Amazon CloudWatch. Once running, the application code inside the container must read data files from an Amazon S3 bucket.

Which two IAM configuration steps must the developer take in the ECS task definition to grant these permissions?

Select all that apply

Show answer & explanation

Answer: Configure the Task Execution Role with permissions to pull the container image from Amazon ECR and send logs to Amazon CloudWatch.; Configure the Task Role with permissions to read objects from the Amazon S3 bucket.

Answer

Configure the Task Execution Role with permissions to pull the container image from Amazon ECR and send logs to Amazon CloudWatch, and configure the Task Role with permissions to read objects from the Amazon S3 bucket.
To deploy the application securely, the developer must use two separate IAM roles. The Task Execution Role is required by the Amazon ECS container agent to authenticate with Amazon ECR to pull the Docker image and to create log streams in Amazon CloudWatch before the container starts. The Task Role is assumed by the application code running inside the container to authorize calls to other AWS services, such as reading files from the Amazon S3 bucket.

Step-by-Step Solution

1
Identify the permissions needed by the ECS agent / container runtime vs the application code.
ECR image pulling and CloudWatch log streaming are performed by the ECS agent, while S3 reading is performed by the application code.
This separation determines which IAM roles need to be configured in the task definition.
2
Assign the ECS agent permissions to the Task Execution Role.
The Task Execution Role receives permissions for ECR and CloudWatch.
The Task Execution Role is used by the infrastructure to set up the task before application code runs.
3
Assign the application permissions to the Task Role.
The Task Role receives permissions for S3 bucket access.
The Task Role is assumed by the containerized application at runtime to make AWS SDK calls.

Key Concept

Distinction between ECS Task Role and ECS Task Execution Role
Question 19Question →

A developer is preparing to deploy a containerized financial API to Amazon ECS using the AWS Fargate launch type. The API application code utilizes the AWS SDK to decrypt sensitive transaction payloads at runtime using a customer managed key in AWS KMS. Additionally, the ECS agent must pull the API container image from a private Amazon ECR repository and send stdout/stderr logs to Amazon CloudWatch Logs. Which two IAM configuration steps must the developer perform to grant the necessary permissions? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Attach a policy allowing the kms:Decrypt action to the IAM role configured as the Task Role in the task definition.; Attach a policy allowing the ecr:BatchGetImage and logs:PutLogEvents actions to the IAM role configured as the Task Execution Role in the task definition.

Answer

The developer must attach a policy allowing the kms:Decrypt action to the Task Role, and attach a policy allowing the ecr:BatchGetImage and logs:PutLogEvents actions to the Task Execution Role.
The application code uses the AWS SDK to decrypt payloads at runtime, which requires the ECS Task Role to have permissions for the kms:Decrypt action. On the other hand, pulling the image from Amazon ECR and writing logs to CloudWatch are operations executed by the ECS agent on the host, meaning the ECS Task Execution Role must have permissions for ECR image pull actions and CloudWatch Logs stream creation/log ingestion.

Step-by-Step Solution

1
Determine the role needed for application-level AWS SDK calls.
The application code running inside the container performs decryption via the AWS SDK at runtime, which requires the ECS Task Role to have kms:Decrypt permissions.
The Task Role provides AWS credentials directly to the containerized application.
2
Determine the role needed for container agent-level tasks.
The ECS container agent needs to pull the container image from ECR and send stdout/stderr logs to CloudWatch Logs, which requires the ECS Task Execution Role to have ecr:BatchGetImage and logs:PutLogEvents permissions.
The Task Execution Role provides AWS credentials to the ECS agent running on the underlying host, enabling it to perform tasks on behalf of the container before it starts.

Key Concept

Delineation between ECS Task Role and ECS Task Execution Role
Question 20Question →

An application running inside a Docker container on Amazon ECS needs to query an Amazon DynamoDB table. Which configuration should the developer specify in the task definition to grant the containerized application permissions to access DynamoDB?

Show answer & explanation

Answer: Define the permissions in the taskRoleArn parameter of the task definition

Answer

Define the permissions in the taskRoleArn parameter of the task definition
The correct option is to define the permissions in the taskRoleArn parameter of the task definition. This assigns an IAM Task Role to the container, which is used by the application inside the container to authorize its calls to services like Amazon DynamoDB using the AWS SDK.

Step-by-Step Solution

1
Determine which component needs to access the Amazon DynamoDB table.
The application code running inside the container needs the access.
This helps distinguish between application-level requirements and container-orchestration-level requirements.
2
Identify the correct parameter in the ECS task definition designed for container application permissions.
The taskRoleArn parameter represents the ECS Task Role.
The Task Role credentials are automatically injected into the container environment for the SDK to use.

Key Concept

ECS Task Role vs Task Execution Role
Page 1 / 3Next