Examkin

Soru

Zorluk: ZorAmazon ECS and Docker Deployment

A company's containerized microservice is being migrated to run on AWS Fargate. During task initialization, the Amazon ECS container agent must retrieve database credentials from AWS Secrets Manager and inject them as environment variables inside the container. The containerized application itself does not make any direct AWS SDK calls. A developer creates a task definition and specifies the Secrets Manager secret ARN in the `secrets` parameter of the container definition. However, when attempting to run the task, it fails to start, showing a `ResourceInitializationError` due to access denied errors while retrieving the secret.

Which configuration change is required to resolve this issue?

  1. Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.Cevap
  2. B
    Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Role (`taskRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.
  3. C
    Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs.amazonaws.com` service principal to assume the role.
  4. D
    Remove the `secrets` parameter from the container definition, hardcode the database credentials in the application's SDK client configuration, and retrieve the secret directly from Secrets Manager at runtime.

Cevap

Attach an IAM policy with the `secretsmanager:GetSecretValue` permission to the Task Execution Role (`executionRoleArn`), and ensure the role's trust policy allows the `ecs-tasks.amazonaws.com` service principal to assume the role.
The correct option correctly identifies that the ECS container agent retrieves the secret before container startup, meaning the permission must be on the Task Execution Role (`executionRoleArn`). It also correctly points out that the trust policy must allow the `ecs-tasks.amazonaws.com` service principal.

Adım Adım Çözüm

1
Identify which role is responsible for secret retrieval during container startup.
The Amazon ECS container agent retrieves the secret and injects it as an environment variable before the application starts, which means this action is performed under the context of the Task Execution Role (`executionRoleArn`).
Permissions for operations performed by the ECS agent (such as pulling images or reading secrets for environment variables) belong to the Task Execution Role, while permissions for the application code itself belong to the Task Role.
2
Determine the required IAM permission and trust policy for the role.
The Task Execution Role must have `secretsmanager:GetSecretValue` permissions, and its trust policy must allow `ecs-tasks.amazonaws.com` to assume the role.
Without the correct trust policy, ECS cannot assume the role to fetch the secret, resulting in a task start failure.

Anahtar Kavram

ECS Task Role vs Task Execution Role for secret management
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru