Examkin

Soru

Zorluk: OrtaAmazon ECS and Docker Deployment

An organization is containerizing a legacy session manager and deploying it as a task on Amazon ECS with the AWS Fargate launch type. The application code requires permissions to write session state directly to an Amazon DynamoDB table. Additionally, the task's container image is hosted within a private Amazon Elastic Container Registry (ECR) repository. The developer needs to establish the correct IAM permissions for both the ECS container agent and the application itself to run successfully.

Which of the following configuration steps must the developer perform? (Select TWO.)

  1. Configure the ECS Task Role with an IAM policy that allows the `dynamodb:PutItem` action.Cevap
  2. Configure the ECS Task Execution Role with an IAM policy that allows the `ecr:GetDownloadUrlForLayer` and `ecr:BatchGetImage` actions.Cevap
  3. C
    Configure the ECS Task Execution Role with an IAM policy that allows the `dynamodb:PutItem` action.
  4. D
    Configure the trust policy of the ECS Task Role to allow the Amazon EC2 service (`ec2.amazonaws.com`) to assume the role.
  5. E
    Include static AWS credentials inside the application's environment configuration within the Dockerfile.

Cevap

To configure the task successfully, the ECS Task Role must be configured with permission to write to DynamoDB (`dynamodb:PutItem`), and the ECS Task Execution Role must be configured with permissions to pull the image from ECR (`ecr:GetDownloadUrlForLayer` and `ecr:BatchGetImage`).
The correct configurations are: 1. Setting the ECS Task Role with an IAM policy that allows the application code to write to DynamoDB (`dynamodb:PutItem`). The Task Role is designed specifically to provide permissions to the application running inside the container. 2. Setting the ECS Task Execution Role with an IAM policy that allows the ECS container agent to pull images from ECR (`ecr:GetDownloadUrlForLayer` and `ecr:BatchGetImage`). The Task Execution Role is used by the ECS container agent to perform lifecycle tasks on behalf of the container before the application begins running.

Adım Adım Çözüm

1
Determine which role is used by the ECS container agent to perform infrastructure actions.
The ECS Task Execution Role is identified as the role used by the ECS agent to pull container images from ECR and write logs to CloudWatch.
The ECS container agent runs outside the user container and requires separate credentials to interact with AWS services before the container starts.
2
Determine which role is used by the application code running inside the container.
The ECS Task Role is identified as the role that provides temporary AWS credentials to the application code container.
The application code uses the AWS SDK to write data to DynamoDB, so the permission must be attached to the Task Role.
3
Verify the trust policy of both roles to ensure they can be assumed by ECS.
The trust policy for both roles must allow the Amazon ECS Task service (`ecs-tasks.amazonaws.com`) to assume the role.
If the trust policy is misconfigured (e.g., set to EC2 instead of ECS Tasks), ECS will not be able to assume the roles, and the task will fail to launch.

Anahtar Kavram

Delineation between the ECS Task Role (granting permissions to the application code inside the container) and the ECS Task Execution Role (granting permissions to the ECS agent/daemon to pull images and push logs).
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru