Examkin

Soru

Zorluk: ZorAmazon ECS and Docker Deployment

A developer is configuring an Amazon ECS task definition to deploy a microservice on AWS Fargate. The microservice retrieves database credentials from AWS Secrets Manager by referencing the secret's ARN in the container definition's `secrets` parameter. Additionally, the application code inside the container reads messages from an Amazon SQS queue. The container uses the `awslogs` log driver to send standard output logs to Amazon CloudWatch Logs. Which configuration of IAM roles correctly implements the principle of least privilege for this deployment?

  1. Configure the Task Execution Role with permissions to retrieve the database credentials from AWS Secrets Manager and write to Amazon CloudWatch Logs. Configure the Task Role with permissions to receive and delete messages from the Amazon SQS queue. Ensure both roles trust the ecs-tasks.amazonaws.com service principal.Cevap
  2. B
    Configure the Task Role with permissions to retrieve the database credentials from AWS Secrets Manager and read from the Amazon SQS queue. Configure the Task Execution Role with permissions to write to Amazon CloudWatch Logs. Ensure both roles trust the ecs-tasks.amazonaws.com service principal.
  3. C
    Configure the Task Execution Role with permissions to write to Amazon CloudWatch Logs. Use Systems Manager Parameter Store with standard unencrypted parameters to store the database credentials, referencing them in the task definition environment variables, and grant the Task Role permission to read them. Configure the Task Role with permissions to read from the Amazon SQS queue.
  4. D
    Configure the Task Execution Role with permissions to retrieve the database credentials from AWS Secrets Manager and write to Amazon CloudWatch Logs. Configure the Task Role with permissions to receive and delete messages from the Amazon SQS queue. Ensure both roles trust the ecs.amazonaws.com service principal.

Cevap

Configure the Task Execution Role with permissions to retrieve the database credentials from AWS Secrets Manager and write to Amazon CloudWatch Logs, configure the Task Role with permissions to receive and delete messages from the Amazon SQS queue, and ensure both roles trust the ecs-tasks.amazonaws.com service principal.
The Task Execution Role grants the ECS agent permissions to pull container images, write logs to CloudWatch using the awslogs log driver, and retrieve secrets from AWS Secrets Manager. The Task Role grants permissions directly to the application running inside the container, allowing it to communicate with Amazon SQS. Both roles must have a trust relationship allowing the ecs-tasks.amazonaws.com service principal to assume them.

Adım Adım Çözüm

1
Identify the actions performed by the Amazon ECS container agent during container initialization.
The agent pulls the container image, retrieves the database secret from AWS Secrets Manager to inject as an environment variable, and configures the awslogs log driver to stream stdout/stderr logs to CloudWatch Logs.
Actions performed by the ECS agent before the application runs must be authorized via the Task Execution Role.
2
Identify the actions performed by the application code running inside the container.
The application code makes calls using the AWS SDK to receive and delete messages from the Amazon SQS queue.
Actions performed by the application code itself must be authorized via the Task Role.
3
Determine the correct trust policy for the IAM roles to allow ECS to assume them.
The trust policy must allow the ecs-tasks.amazonaws.com service principal to assume the roles.
The ecs-tasks.amazonaws.com service principal is required for task-level execution and task role assumption, whereas ecs.amazonaws.com is used for the ECS service level operations.

Anahtar Kavram

Distinction between ECS Task Role and ECS Task Execution Role, including proper IAM trust policies.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru