Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is configuring an Amazon ECS task definition to run a containerized application on AWS Fargate. The application code needs to query an Amazon DynamoDB table. Additionally, the ECS container agent must pull the container image from Amazon ECR and send container logs to Amazon CloudWatch Logs. Which configuration of IAM roles meets these requirements with the least privilege?

  1. Specify an IAM role with permissions to query DynamoDB as the taskRoleArn (Task Role), and specify a separate IAM role with permissions to pull from ECR and write to CloudWatch Logs as the executionRoleArn (Task Execution Role).Cevap
  2. B
    Specify an IAM role with permissions to query DynamoDB, pull from ECR, and write to CloudWatch Logs as the executionRoleArn (Task Execution Role), and leave the taskRoleArn (Task Role) empty.
  3. C
    Specify an IAM role with permissions to pull from ECR and write to CloudWatch Logs as the executionRoleArn (Task Execution Role), and hardcode the access key ID and secret access key of an IAM user with DynamoDB permissions inside the application code.
  4. D
    Specify an IAM role with permissions to query DynamoDB as the taskRoleArn (Task Role), but configure the trust policy of this role to allow the ecs.amazonaws.com service principal to assume the role.

Cevap

Specify an IAM role with permissions to query DynamoDB as the taskRoleArn (Task Role), and specify a separate IAM role with permissions to pull from ECR and write to CloudWatch Logs as the executionRoleArn (Task Execution Role).
The correct configuration uses the Task Role (taskRoleArn) to grant the application code running inside the container permissions to access DynamoDB. Meanwhile, the Task Execution Role (executionRoleArn) grants the ECS container agent permissions to pull the container image from ECR and send logs to CloudWatch. This follows the principle of least privilege and separates infrastructure permissions from application permissions.

Adım Adım Çözüm

1
Identify the credentials needed by the application itself.
The application code queries DynamoDB, which requires read/query permissions on the DynamoDB table.
Application-level permissions must be associated with the ECS Task Role (taskRoleArn).
2
Identify the credentials needed by the ECS container agent.
The agent needs to pull the container image from ECR and create/write log streams in CloudWatch Logs.
Infrastructure/agent-level permissions must be associated with the ECS Task Execution Role (executionRoleArn).
3
Configure the trust relationship for the roles.
Both roles must have a trust policy allowing the ecs-tasks.amazonaws.com service principal to assume them.
This allows the ECS service to pass these temporary credentials to the tasks and the agent.

Anahtar Kavram

Separation of concerns between ECS Task Role and ECS Task Execution Role
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru