Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is configuring a containerized application to run on Amazon ECS using the AWS Fargate launch type. The application needs to read messages from an Amazon SQS queue and write records to an Amazon DynamoDB table. During container initialization, the ECS container agent must pull the container image from Amazon ECR, retrieve a database credential from AWS Secrets Manager to set as an environment variable, and send container logs to Amazon CloudWatch Logs. Which two IAM roles must the developer configure in the ECS task definition to meet these requirements with the minimum required privileges? (Select TWO.)

  1. An ECS Task Execution Role with a policy that allows the ecr:GetAuthorizationToken, ecr:BatchGetImage, secretsmanager:GetSecretValue, and logs:PutLogEvents actions.Cevap
  2. An ECS Task Role with a policy that allows the sqs:ReceiveMessage, sqs:DeleteMessage, and dynamodb:PutItem actions.Cevap
  3. C
    An ECS Task Role with a policy that allows the ecr:BatchGetImage, secretsmanager:GetSecretValue, and logs:PutLogEvents actions.
  4. D
    An ECS Task Execution Role with a policy that allows the sqs:ReceiveMessage, sqs:DeleteMessage, and dynamodb:PutItem actions.
  5. E
    An IAM Instance Role associated with the underlying EC2 instance profile that allows Amazon ECR, AWS Secrets Manager, and Amazon CloudWatch access.

Cevap

An ECS Task Execution Role that allows the container agent to pull images, fetch secrets, and send logs, and an ECS Task Role that allows the application to read from SQS and write to DynamoDB.
The correct solution involves configuring both the ECS Task Execution Role and the ECS Task Role. The Task Execution Role is required by the ECS agent to prepare the environment (pull ECR images, retrieve secrets to set as environment variables, and send container logs to CloudWatch). The Task Role is required by the application code to interact with AWS services like Amazon SQS and Amazon DynamoDB.

Adım Adım Çözüm

1
Analyze the requirements of the ECS container agent versus the application running inside the container.
The container agent needs to pull images, retrieve secrets for environment variables, and configure logging. The application code needs to interact with SQS and DynamoDB.
This separation determines which permissions go to the Task Execution Role and which go to the Task Role.
2
Assign agent-level permissions to the ECS Task Execution Role.
Permissions for ECR image pull, Secrets Manager secret retrieval, and CloudWatch log delivery are assigned to the Task Execution Role.
The ECS agent performs these tasks before launching the application container, so they must be in the execution role.
3
Assign application-level permissions to the ECS Task Role.
Permissions to receive/delete messages from SQS and put items to DynamoDB are assigned to the Task Role.
The application code running inside the container assumes the Task Role to perform its business logic.

Anahtar Kavram

Distinction between ECS Task Role (application permissions) and ECS Task Execution Role (agent/infrastructure permissions) in AWS Fargate.
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru