Examkin

Soru

Zorluk: ZorIAM Policies and Roles

A developer is deploying a containerized application on Amazon ECS using the AWS Fargate launch type. The application is designed to poll an Amazon SQS queue and process incoming messages. The task definition uses the awslogs log driver to send container logs to Amazon CloudWatch Logs. During deployment, the task fails to launch, and the AWS Management Console displays the following error:

ResourceInitializationError: unable to pull secrets or registry auth: execution role does not have permissions to pull from ECR

The developer verifies that two IAM roles are associated with the task definition: ApplicationTaskExecutionRole and ApplicationTaskRole.

Which action must the developer take to resolve the container startup failure and ensure the application can poll the SQS queue once running?

  1. Attach a policy allowing ecr:GetDownloadUrlForLayer and ecr:BatchGetImage to the ApplicationTaskExecutionRole, and attach a policy allowing sqs:ReceiveMessage and sqs:DeleteMessage to the ApplicationTaskRole.Cevap
  2. B
    Attach a policy allowing ecr:GetDownloadUrlForLayer and ecr:BatchGetImage to the ApplicationTaskRole, and attach a policy allowing sqs:ReceiveMessage and sqs:DeleteMessage to the ApplicationTaskExecutionRole.
  3. C
    Attach a policy containing ECR, SQS, and CloudWatch permissions to the ApplicationTaskExecutionRole, and configure the ApplicationTaskRole trust policy to allow it to assume the ApplicationTaskExecutionRole.
  4. D
    Attach a policy allowing ecr:GetDownloadUrlForLayer and sqs:ReceiveMessage to the ApplicationTaskExecutionRole, and leave the ApplicationTaskRole unconfigured since Fargate tasks run in a shared security context.

Cevap

Attach ECR pull permissions to the ApplicationTaskExecutionRole, and attach SQS permissions to the ApplicationTaskRole.
The Task Execution Role is utilized by the ECS container agent to perform actions on behalf of the task before the container starts, such as pulling the image from Amazon ECR and writing logs to CloudWatch. The Task Role is assumed by the application running inside the container to make AWS SDK calls, such as polling the Amazon SQS queue. Therefore, ECR permissions must be attached to the Task Execution Role, and SQS permissions must be attached to the Task Role.

Adım Adım Çözüm

1
Analyze the error message from the ECS console.
The error shows that the ECS agent failed to pull the image from ECR due to insufficient permissions on the execution role.
The ECS Task Execution Role is responsible for task lifecycle operations managed by the ECS agent before the containerized application starts.
2
Identify the role needed for application-level AWS API calls.
The application container needs to poll the SQS queue at runtime, which requires SQS permissions.
The ECS Task Role is the role assumed by the containerized application at runtime to make calls to AWS services.
3
Determine the correct permission assignments.
Attach ecr:GetDownloadUrlForLayer and ecr:BatchGetImage to the ApplicationTaskExecutionRole, and sqs:ReceiveMessage/sqs:DeleteMessage to the ApplicationTaskRole.
This adheres to the principle of least privilege and correctly separates container execution agent credentials from runtime application credentials.

Anahtar Kavram

Distinction between ECS Task Role and ECS Task Execution Role
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru