Examkin

Soru

Zorluk: OrtaAmazon ECS and Docker Deployment

A developer is configuring an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application is configured to stream logs to Amazon CloudWatch using the `awslogs` log driver, and it retrieves a database password from AWS Secrets Manager by referencing the secret in the container definition's environment variables. Inside the container, the application code uses the AWS SDK to write processed reports to an Amazon S3 bucket.

Which of the following IAM configurations must the developer apply to allow the task to run and successfully perform all of these operations?

  1. A
    Attach an IAM policy with s3:PutObject permissions to the ECS Task Execution Role, and attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Role. Ensure both roles trust ecs-tasks.amazonaws.com.
  2. B
    Attach an IAM policy with s3:PutObject permissions to the ECS Task Role, and attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Execution Role. Configure the trust policy of both roles to trust the ecs.amazonaws.com service principal.
  3. Attach an IAM policy with s3:PutObject permissions to the ECS Task Role, and attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Execution Role. Configure the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal.Cevap
  4. D
    Embed AWS IAM access keys with s3:PutObject permissions directly in the application code. Attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Execution Role.

Cevap

Attach an IAM policy with s3:PutObject permissions to the ECS Task Role, and attach policies with logs:CreateLogStream, logs:PutLogEvents, and secretsmanager:GetSecretValue permissions to the ECS Task Execution Role. Configure the trust policy of both roles to trust the ecs-tasks.amazonaws.com service principal.
The correct answer properly separates the runtime application permissions (S3 upload) into the Task Role and the container agent's operational permissions (CloudWatch logs and Secrets Manager retrieval) into the Task Execution Role. It also correctly specifies the ecs-tasks.amazonaws.com service principal in the trust policy of both roles to allow Amazon ECS to assume them.

Adım Adım Çözüm

1
Differentiate between the permissions needed by the application runtime and those needed by the ECS agent.
The application code needs S3 permissions, which requires the ECS Task Role. The ECS container agent needs CloudWatch Logs and Secrets Manager permissions to set up the container, which requires the ECS Task Execution Role.
Splitting these permissions correctly conforms to the principle of least privilege and allows both the agent and application to execute successfully.
2
Verify the correct trust relationship service principal for ECS task roles.
Both roles must specify the ecs-tasks.amazonaws.com service principal in their trust policy.
This allows the ECS service to assume these roles on behalf of the tasks running on AWS Fargate.

Anahtar Kavram

Differentiating between the ECS Task Role and the ECS Task Execution Role is critical when deploying containerized applications. The Task Role is assumed by the application code inside the container to make AWS API calls, whereas the Task Execution Role is assumed by the Amazon ECS container agent to perform setup operations like pulling images, writing logs to CloudWatch, and reading environment variables from Systems Manager Parameter Store or Secrets Manager.
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru