Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is deploying a microservice to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The microservice needs to read messages from an Amazon SQS queue and write records to an Amazon DynamoDB table. During startup, the ECS container agent must pull the container image from Amazon Elastic Container Registry (Amazon ECR) and send container logs to Amazon CloudWatch Logs. Which configuration of IAM roles should the developer specify in the task definition to satisfy these requirements with the least privilege?

  1. Assign an IAM role with permissions for SQS and DynamoDB as the Task Role, and assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Execution Role.Cevap
  2. B
    Assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Role, and assign an IAM role with permissions for SQS and DynamoDB as the Task Execution Role.
  3. C
    Assign an IAM role with permissions for SQS, DynamoDB, ECR, and CloudWatch Logs as the Task Role, and do not assign a Task Execution Role.
  4. D
    Assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Execution Role, and hardcode the AWS access keys for SQS and DynamoDB in the application configuration inside the container.

Cevap

Assign an IAM role with permissions for SQS and DynamoDB as the Task Role, and assign an IAM role with permissions for ECR and CloudWatch Logs as the Task Execution Role.
The correct configuration assigns the application permissions (SQS and DynamoDB) to the Task Role, and infrastructure/agent permissions (ECR image pull and CloudWatch logging) to the Task Execution Role. The ECS agent needs the Task Execution Role to pull the container image and set up logs before starting the container, while the application code inside the container uses the Task Role to interact with AWS services.

Adım Adım Çözüm

1
Identify the credentials required by the application code running inside the container.
The application code requires SQS and DynamoDB access.
The containerized application needs these permissions to execute its business logic after startup.
2
Identify the permissions required by the Amazon ECS container agent to provision and start the task.
The ECS agent requires ECR image pull and CloudWatch logging permissions.
These permissions are needed by the container agent before the container is running.
3
Map these requirements to the appropriate ECS task definition parameters.
The Task Role is assigned to the application, and the Task Execution Role is assigned to the ECS agent.
This separation follows the AWS security model and least-privilege principles.

Anahtar Kavram

ECS Task Role vs. ECS Task Execution Role distinction in IAM configurations
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru