A development team is migrating a legacy backend API to run on Amazon ECS with the AWS Fargate launch type. The deployment process requires the Amazon ECS agent to authenticate with a private Amazon ECR registry to retrieve the Docker image and to configure log streams in Amazon CloudWatch. Which of the following IAM configuration steps are required to enable this setup? (Select two.)
- Assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch.Cevap
- Configure the trust policy of the Task Execution Role to permit the Amazon ECS Tasks service principal (ecs-tasks.amazonaws.com) to assume the role.Cevap
- CAssign an ECS Task Role containing permissions to retrieve the container image from the Amazon ECR registry.
- DStore IAM User access keys in the application's config file inside the container to authenticate the ECR image pull.
- EUpdate the Task Execution Role trust policy to trust the Amazon EC2 service principal (ec2.amazonaws.com) to assume the role.
Cevap
To successfully deploy the tasks on Fargate, you must assign an ECS Task Execution Role containing ECR pull and CloudWatch logging permissions, and update its trust policy to allow the ecs-tasks.amazonaws.com service principal to assume it.
The correct options state that we must assign an ECS Task Execution Role to the task definition containing permissions to pull the image from Amazon ECR and write logs to CloudWatch, and configure the trust policy of this role to permit the Amazon ECS Tasks service principal to assume it. This ensures that the ECS agent, running outside the container space, has the necessary permissions to retrieve the container image and initialize logging.
Adım Adım Çözüm
Anahtar Kavram
Distinction between ECS Task Role and ECS Task Execution Role, and configuring appropriate trust relationships.
Tahmini Süre:1m 0s