Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is deploying a containerized application to Amazon ECS using AWS Fargate. The application needs to perform read and write operations on an Amazon DynamoDB table. Additionally, the ECS agent must pull the container image from a private Amazon ECR repository and send container startup logs to Amazon CloudWatch Logs.

To satisfy these security requirements using the principle of least privilege, how should the developer configure the IAM roles?

  1. Define an ECS Task Role with a permissions policy allowing DynamoDB actions and assign it to the task definition. Define an ECS Task Execution Role with a permissions policy allowing ECR and CloudWatch logs actions, and assign it as the execution role in the task definition.Cevap
  2. B
    Define an ECS Task Execution Role with a permissions policy allowing DynamoDB actions and assign it to the task definition. Define an ECS Task Role with a permissions policy allowing ECR and CloudWatch logs actions, and assign it as the execution role.
  3. C
    Configure the application code to initialize the AWS SDK client with static IAM user access keys that have DynamoDB, ECR, and CloudWatch permissions, rather than using ECS IAM roles.
  4. D
    Define a single IAM role with a trust policy that allows both the DynamoDB service and the ECR service to assume the role, and attach a permissions policy allowing all actions to this role.

Cevap

Define an ECS Task Role with a permissions policy allowing DynamoDB actions and assign it to the task definition. Define an ECS Task Execution Role with a permissions policy allowing ECR and CloudWatch logs actions, and assign it as the execution role in the task definition.
The correct configuration uses two distinct roles to enforce the principle of least privilege. The ECS Task Role is designated for credentials needed by the application itself running inside the container (e.g., calling DynamoDB APIs). The ECS Task Execution Role is designated for actions performed by the Amazon ECS container agent (e.g., pulling the Docker image from Amazon ECR and sending container logs to Amazon CloudWatch). Specifying both correctly in the task definition allows the containerized workload to execute securely.

Adım Adım Çözüm

1
Analyze the container application permissions needs.
The application inside the container makes API requests to write and read from DynamoDB.
These application-level permissions must be mapped to the ECS Task Role.
2
Analyze the infrastructure and agent permissions needs.
The ECS Fargate agent needs to pull images from ECR and write system/startup logs to CloudWatch.
These agent-level infrastructure permissions must be mapped to the ECS Task Execution Role.
3
Map roles to the ECS task definition parameters.
Assign the DynamoDB role to taskRoleArn, and the ECR/CloudWatch role to executionRoleArn.
This separation follows AWS security best practices for container permissions.

Anahtar Kavram

ECS Task Role vs ECS Task Execution Role separation of duties
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru