Examkin

Question

Difficulty: HardIAM Policies, Roles, and Service Control Policies (SCPs)

A SysOps administrator is configuring an automated CI/CD pipeline in Account A (111111111111111111111111) to register a new Amazon ECS task definition and deploy a service on AWS Fargate. The task definition specifies an ECS Task Execution Role (`ECSTaskExecutionRole`) and an ECS Task Role (`ECSTaskRole`). The pipeline runs using the credentials of an IAM user named `PipelineDeployer`. During deployment, the pipeline fails with an error indicating that `PipelineDeployer` is not authorized to perform `iam:PassRole` on the role resources. Additionally, the application inside the ECS container must read configuration files from an Amazon S3 bucket located in Account B (222222222222222222222222). Which of the following configuration changes are required to resolve the deployment failure and grant the application the necessary runtime permissions? (Select TWO.)

  1. Attach an IAM policy to the PipelineDeployer user in Account A that grants the iam:PassRole permission on the ECSTaskRole and ECSTaskExecutionRole ARNs.Answer
  2. Attach an IAM policy to the ECSTaskRole in Account A that grants s3:GetObject permission on the S3 bucket in Account B, and configure the S3 bucket policy in Account B to allow access from the ECSTaskRole ARN.Answer
  3. C
    Attach an IAM policy to the PipelineDeployer user in Account A that grants the sts:AssumeRole permission on the ECSTaskRole and ECSTaskExecutionRole ARNs.
  4. D
    Attach an IAM policy to the ECSTaskExecutionRole in Account A that grants s3:GetObject permission on the S3 bucket in Account B, and configure the S3 bucket policy in Account B to allow access from the ECSTaskExecutionRole ARN.
  5. E
    Configure a trust policy on the PipelineDeployer user in Account A to trust the ecs-tasks.amazonaws.com service principal.

Answer

Attach an IAM policy to the PipelineDeployer user in Account A that grants the iam:PassRole permission on the roles, and attach an IAM policy to the ECSTaskRole in Account A that grants access to the S3 bucket in Account B while configuring the S3 bucket policy to permit the role.
The correct options identify the proper application of permissions. First, the PipelineDeployer user needs the iam:PassRole permission to associate the IAM roles with the ECS task definition during deployment. Second, the containerized application uses the ECS Task Role to make AWS API calls, meaning that S3 access must be granted to the ECS Task Role, and the cross-account bucket policy must allow that role's ARN.

Step-by-Step Solution

1
Analyze the deployment error.
The deployment fails due to a missing iam:PassRole permission for the PipelineDeployer user.
When creating or updating ECS tasks that use IAM roles, the deploying principal must have permission to pass those roles to the AWS service.
2
Address the runtime permission requirement.
Identify that the application code runs under the ECS Task Role, whereas the ECS container agent runs under the ECS Task Execution Role.
To retrieve configuration files from S3, the ECS Task Role must have the s3:GetObject permission, and the bucket policy in the target account must trust the ECS Task Role ARN.
3
Formulate the correct configuration changes.
Grant iam:PassRole to the PipelineDeployer user, and grant S3 access to the ECSTaskRole while establishing cross-account trust in the S3 bucket policy.
This resolves both the deployment-time permission issue and the run-time cross-account resource access issue.

Key Concept

ECS Task Role vs. ECS Task Execution Role and the necessity of the iam:PassRole permission for deployment identities.
Rate this question

Topics

IAM Policies, Roles, and Service Control Policies (SCPs)

More questions from this topic