Examkin

Soru

Zorluk: OrtaAmazon ECS and Docker Deployment

A developer is creating an Amazon ECS task definition to deploy a containerized application on AWS Fargate. The application needs to pull its container image from a private Amazon ECR repository in the same AWS account. Additionally, the application code itself must make calls to the Amazon Translate API to translate user reviews at runtime. Which configuration of IAM roles will allow the task to pull the image and run successfully with the least privilege?

  1. Specify an IAM role in the taskExecutionRoleArn parameter that allows the Amazon ECS agent to pull the image from Amazon ECR, and specify a different IAM role in the taskRoleArn parameter that allows the containerized application to call the Amazon Translate API.Cevap
  2. B
    Specify an IAM role in the taskRoleArn parameter that allows ECR image retrieval, and specify a different IAM role in the taskExecutionRoleArn parameter that allows the containerized application to call the Amazon Translate API.
  3. C
    Specify an IAM role in the taskRoleArn parameter that allows Amazon Translate access with a trust policy that trusts the ec2.amazonaws.com service, and specify an IAM role in the taskExecutionRoleArn parameter that allows ECR image retrieval.
  4. D
    Specify an IAM role in the taskExecutionRoleArn parameter that allows ECR image retrieval, and configure the container environment variables to pass the AWS access key and secret access key of an IAM user with Amazon Translate permissions.

Cevap

Specify an IAM role in the taskExecutionRoleArn parameter that allows the Amazon ECS agent to pull the image from Amazon ECR, and specify a different IAM role in the taskRoleArn parameter that allows the containerized application to call the Amazon Translate API.
The correct configuration uses the Task Execution Role (taskExecutionRoleArn) to grant the Amazon ECS agent permissions to pull the image from Amazon ECR, and uses the Task Role (taskRoleArn) to grant the application running inside the container permission to call the Amazon Translate API. This respects the least-privilege model and aligns with how ECS handles agent-level versus container-level permissions.

Adım Adım Çözüm

1
Determine the resource access required by the ECS agent versus the application container.
The Amazon ECS agent requires access to Amazon ECR to pull the image. The application code inside the container requires access to Amazon Translate.
The container infrastructure must pull the container image before startup. Once the container is running, the application code makes outgoing calls to other AWS APIs.
2
Map the access requirements to the correct ECS task definition role parameters.
Assign ECR access to the Task Execution Role (taskExecutionRoleArn) and Translate access to the Task Role (taskRoleArn).
The Task Execution Role is for ECS agent infrastructure activities (ECR pull, CloudWatch log streams). The Task Role is for the containerized application's own SDK calls.
3
Verify that the trust relationships are configured correctly and that credentials are secure.
Ensure both roles trust the 'ecs-tasks.amazonaws.com' service principal, avoiding the use of hardcoded IAM user keys.
ECS tasks must be allowed to assume these roles. Utilizing the Task Role provides automated credential rotation, ensuring security.

Anahtar Kavram

Distinction between ECS Task Role and ECS Task Execution Role
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru