Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is configuring an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application running inside the container needs to write records to an Amazon Kinesis data stream. During task startup, the Amazon ECS container agent must pull the private container image from Amazon Elastic Container Registry (Amazon ECR) and retrieve a database password from AWS Secrets Manager.

The developer creates an IAM role named AppTaskRole to grant the application access to the Kinesis data stream. However, when attempting to run the task, the container agent fails to pull the image and cannot retrieve the secret.

Which TWO actions must the developer perform to resolve this issue?

  1. Configure the task definition by specifying an IAM role with policies that allow ECR image pull and Secrets Manager read permissions as the Task Execution Role (executionRoleArn).Cevap
  2. Configure the task definition by specifying the AppTaskRole, which contains Kinesis write permissions, as the Task Role (taskRoleArn).Cevap
  3. C
    Attach the ECR image pull and Secrets Manager read permissions directly to AppTaskRole and omit the Task Execution Role configuration in the task definition.
  4. D
    Modify the trust policy of the IAM roles to allow the ecs.amazonaws.com service principal to assume the roles.
  5. E
    Inject static AWS access keys and secret keys as container environment variables in the task definition to authenticate the application client.

Cevap

Specify an IAM role with ECR and Secrets Manager permissions as the Task Execution Role, and associate the AppTaskRole with Kinesis permissions as the Task Role in the task definition.
The correct configurations describe the separate roles required by ECS Fargate tasks: the Task Execution Role (executionRoleArn) is used by the ECS container agent to pull ECR images and retrieve Secrets Manager secrets, while the Task Role (taskRoleArn) is assumed by the application code running inside the container to make AWS API requests like writing to a Kinesis data stream.

Adım Adım Çözüm

1
Differentiate between container agent tasks and application container tasks.
The ECS agent performs the image pull and secret resolution before container startup. The application container performs the Kinesis write operations during execution.
ECS Fargate separates operations performed by the infrastructure agent from operations performed by the application code itself.
2
Assign the appropriate role to the executionRoleArn configuration parameter.
The ECS agent is authorized to pull ECR images and read Secrets Manager secrets.
The Task Execution Role provides credentials to the ECS container agent.
3
Assign the AppTaskRole to the taskRoleArn configuration parameter.
The application code running inside the container receives credentials to write to the Kinesis data stream.
The Task Role provides credentials directly to the containerized application.

Anahtar Kavram

Distinguishing ECS Task Role from ECS Task Execution Role
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru