Examkin

Soru

Zorluk: OrtaResolving IAM and Authorization Failures

A developer is deploying a containerized application to Amazon ECS using AWS Fargate. During task startup, the container fails to launch. The ECS service events reveal that the task is unauthorized to pull the application image from Amazon Elastic Container Registry (ECR). In addition, the container is configured to retrieve a database secret from AWS Secrets Manager at startup, which is also failing. The developer verifies that the IAM policy attached to the ECS Task Role (task_role_arn) has the necessary ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and secretsmanager:GetSecretValue permissions.

What action should the developer take to resolve these authorization failures?

  1. A
    Configure an Amazon Cognito Identity Pool to exchange temporary credentials during task initialization.
  2. B
    Update the trust policy of the ECS Task Role to allow the Secrets Manager service principal (secretsmanager.amazonaws.com) to assume the role.
  3. C
    Embed the ECR registry credentials and Secrets Manager secrets directly inside the application's source code.
  4. Attach the required permissions to the ECS Task Execution Role instead of the ECS Task Role.Cevap

Cevap

Attach the required permissions to the ECS Task Execution Role instead of the ECS Task Role.
The Amazon ECS container agent makes the API calls to pull the container image from Amazon ECR and to retrieve secrets from AWS Secrets Manager during the task bootstrap phase. These operations occur before the application container is running. Therefore, the permissions must be attached to the ECS Task Execution Role, not the ECS Task Role (which is used by the application code once running).

Adım Adım Çözüm

1
Identify the entity performing the unauthorized actions during the task bootstrap phase.
Determine that the Amazon ECS container agent (not the application code) pulls the image from Amazon ECR and retrieves secrets from AWS Secrets Manager.
Understanding which entity performs these tasks is essential to choosing the correct IAM role.
2
Distinguish between the ECS Task Role and the ECS Task Execution Role.
The ECS Task Role is assumed by the containers after they start to make AWS API calls from application code. The ECS Task Execution Role is used by the ECS container agent to perform actions on behalf of the task before the container runs.
Matching the bootstrap permissions to the correct role prevents authorization errors during initialization.
3
Move the permissions to the correct role.
Attach the Amazon ECR and Secrets Manager permissions to the ECS Task Execution Role.
This grants the ECS container agent the authority to pull the container image and read the secret required to start the task.

Anahtar Kavram

ECS Task Role vs. ECS Task Execution Role permissions
Bu soruyu puanla

Konular

Resolving IAM and Authorization Failures

Bu konudan daha fazla soru