Examkin

Soru

Zorluk: KolayResolving IAM and Authorization Failures

A developer has deployed a containerized application to Amazon ECS on AWS Fargate. The application code needs to retrieve customer records from an Amazon DynamoDB table. During execution, the container logs display an AccessDeniedException when attempting to call DynamoDB API operations. The developer verifies that the ECS task execution role has an attached policy allowing the necessary DynamoDB permissions. How should the developer resolve this authorization failure?

  1. A
    Ensure the DynamoDB policy is attached to the ECS task execution role and configure the container definition to enable runtime credential sharing.
  2. Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.Cevap
  3. C
    Modify the trust relationship of the ECS task execution role to allow the DynamoDB service to assume the role.
  4. D
    Configure an Amazon Cognito Identity Pool to exchange credentials for the container and map them to the task execution role.

Cevap

Attach the DynamoDB permission policy to the ECS task role instead of the ECS task execution role.
The correct answer is correct because the ECS task role is designed specifically to grant AWS API permissions to the application code running inside containerized tasks. The ECS task execution role is intended for the container agent itself to pull images from Amazon ECR and push logs to CloudWatch.

Adım Adım Çözüm

1
Distinguish between ECS Task Role and ECS Task Execution Role.
Identify that the Task Role is used by the application code running inside the container, whereas the Task Execution Role is used by the ECS container agent for infrastructure tasks (like pulling ECR images and writing CloudWatch logs).
Correctly identifying which identity runs the application code is necessary to assign API permissions.
2
Review the current IAM policy attachment.
Verify that the policy permitting DynamoDB actions is attached to the Task Execution Role, which explains why the application receives an AccessDeniedException.
Locating where the permission is incorrectly applied helps determine the required fix.
3
Migrate the permission policy to the ECS Task Role.
The application code is now successfully authorized to query the DynamoDB table.
Attaching permissions to the Task Role grants the running container the access credentials it needs.

Anahtar Kavram

ECS Task Role vs. ECS Task Execution Role
Bu soruyu puanla

Konular

Resolving IAM and Authorization Failures

Bu konudan daha fazla soru