Examkin

Soru

Zorluk: OrtaAmazon ECS and Docker Deployment

A developer is deploying a containerized application to Amazon ECS using the AWS Fargate launch type. The application requires a database connection string that is stored as a secure string in Systems Manager Parameter Store. The developer wants the connection string to be automatically injected as a container environment variable at startup without modifying the application code to retrieve it. Which configuration will meet these requirements?

  1. Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Execution Role.Cevap
  2. B
    Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Role.
  3. C
    Retrieve the connection string from Systems Manager Parameter Store at runtime by hardcoding an IAM user's Access Key ID and Secret Access Key in the application's configuration code inside the container.
  4. D
    Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, assign `ssm:GetParameters` permissions to the ECS Task Execution Role, and set the role's trust policy to trust `ec2.amazonaws.com` to assume the role.

Cevap

Reference the Parameter Store parameter ARN in the `secrets` section of the task's container definition, and assign an IAM role with `ssm:GetParameters` permissions to the ECS Task Execution Role.
Referencing the Systems Manager Parameter Store parameter ARN in the `secrets` section of the container definition tells the ECS agent to retrieve the parameter and inject it as an environment variable at container startup. Because this action is performed by the ECS container agent before the containerized application is running, the ECS Task Execution Role must contain the `ssm:GetParameters` permission.

Adım Adım Çözüm

1
Identify the component responsible for retrieving the secret at container startup.
The Amazon ECS container agent is responsible for fetching the secret and injecting it as an environment variable before the application starts.
Since the application code itself is not retrieving the secret via the SDK, the ECS agent needs the direct permission.
2
Select the correct IAM role for the ECS container agent permissions.
The Task Execution Role must be used.
The Task Execution Role is utilized by the ECS agent to perform actions on behalf of the task (such as pulling container images, writing logs, and retrieving secrets), whereas the Task Role is for the application container itself.
3
Configure the task definition container definition.
Map the environment variable in the `secrets` array pointing to the SSM Parameter Store parameter ARN, and ensure the trust policy of the Task Execution Role allows the `ecs-tasks.amazonaws.com` service to assume it.
This binds the parameter to the environment variable securely and allows the ECS service to successfully assume the execution role.

Anahtar Kavram

Delineation between ECS Task Role and ECS Task Execution Role for secret management
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru