Examkin

Soru

Zorluk: ZorAmazon ECS and Docker Deployment

A developer is preparing to deploy a containerized API service to Amazon ECS using the AWS Fargate launch type. The application is packaged in a Docker image stored in a private Amazon ECR repository. During runtime, the application code must poll an Amazon SQS queue to retrieve incoming messages, and write custom metrics to Amazon CloudWatch. Additionally, the container must use the `awslogs` log driver to send standard output streams to CloudWatch Logs, and retrieve a database password securely from AWS Systems Manager Parameter Store (stored as a `SecureString` parameter) to set a container environment variable at launch. Which combination of configurations must the developer implement to meet these requirements? (Select TWO.)

  1. Configure an ECS Task Execution Role with permissions for `ecr:BatchGetImage`, `ecr:GetDownloadUrlForLayer`, `logs:PutLogEvents`, and `ssm:GetParameters`.Cevap
  2. Configure an ECS Task Role with permissions for `sqs:ReceiveMessage`, `sqs:DeleteMessage`, and `cloudwatch:PutMetricData`.Cevap
  3. C
    Configure the ECS Task Role with permissions to read the database password from Parameter Store and write logs via the `awslogs` driver.
  4. D
    Configure the ECS Task Execution Role with permissions to poll the Amazon SQS queue and write custom metrics to CloudWatch.
  5. E
    Configure the trust policy of the ECS Task Execution Role to allow the Amazon EC2 service (`ec2.amazonaws.com`) to assume the role.

Cevap

Configure the ECS Task Execution Role with permissions for pulling ECR images, writing logs, and retrieving Parameter Store parameters, and configure the ECS Task Role with permissions for SQS operations and CloudWatch metrics write actions.
The correct configurations properly separate the ECS Task Execution Role (used by the ECS container agent to prepare the container environment, pull the image from Amazon ECR, set up CloudWatch logging, and pull parameters from Systems Manager Parameter Store) and the ECS Task Role (used by the application code running inside the container to interact with AWS services, such as reading from SQS and writing custom metrics to CloudWatch).

Adım Adım Çözüm

1
Identify the entities performing the required actions.
The ECS agent pulls the ECR image, sends logs via the `awslogs` driver, and retrieves the Parameter Store secret. The application code inside the container polls SQS and writes custom metrics.
ECS distinguishes agent-level bootstrapping tasks from container-level application tasks.
2
Assign agent-level boot permissions.
Define an ECS Task Execution Role with ECR pull, CloudWatch logs write, and Systems Manager Parameter Store get parameter permissions.
The ECS agent needs these permissions before the container starts running.
3
Assign application-level execution permissions.
Define an ECS Task Role with SQS poll/delete and custom CloudWatch metrics write permissions.
The application code inside the running container assumes the Task Role to interact with other AWS services.

Anahtar Kavram

Separation of concerns between the ECS Task Execution Role and the ECS Task Role.
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru