Examkin

Soru

Zorluk: OrtaAmazon ECS and Docker Deployment

A developer is configuring an Amazon ECS service on AWS Fargate to deploy a containerized application. The Docker image is hosted in a private Amazon Elastic Container Registry (ECR) repository located in a separate, central AWS account. The Fargate tasks will run in a private subnet within the developer's AWS account. Which configuration is required to allow the ECS service to successfully pull the container image and deploy the application?

  1. A
    Configure the ECS Task Role in the developer's account with permissions to call ecr:GetAuthorizationToken and pull the image. Update the central ECR repository policy to allow access to the developer's ECS Task Role ARN, and configure VPC endpoints for ECR and Amazon S3.
  2. B
    Modify the ECS Task Execution Role's trust policy to trust the central AWS account ID. Configure the central ECR repository to assume this role when retrieving images, and configure VPC endpoints for ECR and Amazon S3.
  3. Configure the ECS Task Execution Role in the developer's account with permissions to call ecr:GetAuthorizationToken and pull the image. Update the central ECR repository policy to allow access to the developer's ECS Task Execution Role ARN, and configure VPC endpoints for ECR and Amazon S3.Cevap
  4. D
    Hardcode the central account's IAM user credentials in the task definition's container environment variables to authenticate the container registry pull, and configure VPC endpoints for ECR and Amazon S3.

Cevap

Configure the ECS Task Execution Role in the developer's account with permissions to call ECR APIs and pull the image, update the central ECR repository policy to trust this role, and establish VPC endpoints for ECR and Amazon S3.
The correct configuration uses the ECS Task Execution Role because the ECS container agent is responsible for pulling the image and authenticating with Amazon ECR. Since the ECR repository is in another account, the repository policy in that central account must trust the Task Execution Role ARN from the developer's account. Finally, because the Fargate task runs in a private subnet, VPC endpoints for ECR and S3 (or a NAT Gateway) are required for the ECS agent to communicate with ECR.

Adım Adım Çözüm

1
Determine which role is responsible for pulling container images in ECS.
The ECS Task Execution Role is identified as the role used by the ECS container agent to perform lifecycle tasks such as pulling images and writing logs, whereas the ECS Task Role provides permissions to the application code itself.
This establishes that permissions must be attached to the Task Execution Role rather than the Task Role.
2
Configure permissions for cross-account ECR access.
The ECS Task Execution Role in the developer's account is granted ECR read permissions, and the ECR repository policy in the central account is updated to allow the developer's Task Execution Role ARN to perform ecr actions.
This allows the ECS agent to authenticate and pull the image across AWS accounts.
3
Ensure network connectivity to ECR and S3 from the private subnet.
VPC endpoints for ECR and S3 are created in the developer's VPC.
Because the Fargate tasks run in a private subnet, they require private endpoints to communicate with ECR and download the container image layers stored in S3.

Anahtar Kavram

Distinction between ECS Task Role and Task Execution Role in cross-account ECR deployments
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru