Examkin

Soru

Zorluk: OrtaAmazon ECS and Docker Deployment

A development team is preparing to deploy an application to Amazon ECS using the AWS Fargate launch type. The application container needs to pull its Docker image from a private Amazon ECR repository. Once the container is running, the application code needs to retrieve data from an Amazon S3 bucket.

Which IAM role configuration is required in the task definition to support this deployment?

  1. A
    Assign a single IAM role containing both ECR pull and S3 read permissions to the Task Role, and leave the Task Execution Role empty.
  2. Assign an IAM role with S3 read permissions to the Task Role, and assign an IAM role with ECR pull permissions to the Task Execution Role.Cevap
  3. C
    Assign an IAM role with ECR pull permissions to the Task Role, and assign an IAM role with S3 read permissions to the Task Execution Role.
  4. D
    Assign an IAM role with both ECR pull and S3 read permissions to the Task Execution Role, and add a trust relationship allowing the ECS task to assume itself.

Cevap

Assign an IAM role with S3 read permissions to the Task Role, and assign an IAM role with ECR pull permissions to the Task Execution Role.
The correct option correctly maps S3 read permissions to the Task Role and ECR pull permissions to the Task Execution Role. When using AWS Fargate, the ECS container agent runs outside the user container and needs credentials to pull the image from ECR and write logs; these permissions must be in the Task Execution Role. Once the container is running, the application code runs inside the container and requires separate credentials to access AWS resources like Amazon S3; these permissions must be in the Task Role.

Adım Adım Çözüm

1
Identify the entity responsible for pulling the Docker container image from Amazon ECR.
The Amazon ECS container agent is responsible for pulling the image before the container starts.
The container agent runs outside the user's container and requires AWS credentials to pull from a private ECR repository.
2
Determine which IAM role provides permissions to the ECS container agent.
The Task Execution Role provides these credentials.
AWS Fargate uses the Task Execution Role for actions the ECS agent performs on your behalf (such as pulling ECR images and pushing logs to CloudWatch).
3
Identify the entity running the application code and the AWS services it needs to access.
The application code runs inside the container and needs to access Amazon S3.
The Task Role supplies temporary AWS credentials directly to the containerized application at runtime.

Anahtar Kavram

Distinction between ECS Task Role and ECS Task Execution Role
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru