Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is deploying a containerized application on Amazon ECS (Fargate). The application needs to read messages from an Amazon SQS queue and write items to an Amazon DynamoDB table. During deployment, the developer notices that the container starts up successfully but fails with an AccessDenied error when attempting to write to the DynamoDB table. Which of the following configurations will resolve this authorization issue while following the principle of least privilege?

  1. Attach an IAM policy with permissions for sqs:ReceiveMessage and dynamodb:PutItem to an IAM role, configure this role as the taskRoleArn in the ECS task definition, and ensure the role's trust policy allows the ecs-tasks.amazonaws.com service principal to assume the role.Cevap
  2. B
    Attach an IAM policy with permissions for sqs:ReceiveMessage and dynamodb:PutItem to the ECS Task Execution Role (executionRoleArn) so that the container agent can pass these permissions to the application at runtime.
  3. C
    Generate long-term IAM access keys with SQS and DynamoDB permissions, store them in the application's environment variables, and configure the application code to explicitly initialize the AWS SDK client with these credentials.
  4. D
    Attach an IAM policy with permissions for sqs:ReceiveMessage and dynamodb:PutItem to an IAM role, configure this role as the taskRoleArn in the ECS task definition, and ensure the role's trust policy allows the ecs.amazonaws.com service principal to assume the role.

Cevap

Attach an IAM policy with permissions for sqs:ReceiveMessage and dynamodb:PutItem to an IAM role, configure this role as the taskRoleArn in the ECS task definition, and ensure the role's trust policy allows the ecs-tasks.amazonaws.com service principal to assume the role.
The correct configuration is to create an IAM role for the task itself (ECS Task Role) and attach the necessary application permissions (sqs:ReceiveMessage and dynamodb:PutItem). The trust policy of this IAM role must allow the 'ecs-tasks.amazonaws.com' service principal to assume the role. This permits the containerized application to automatically fetch temporary security credentials using the AWS SDK.

Adım Adım Çözüm

1
Differentiate between the ECS Task Role and the ECS Task Execution Role.
Identify that permissions required by the application code itself (like DynamoDB and SQS access) must be granted via the Task Role (taskRoleArn), while permissions required by the ECS agent (like ECR image pulls) use the Task Execution Role.
This ensures the application container obtains the necessary credentials at runtime.
2
Configure the IAM role trust policy.
Verify that the trust relationship of the Task Role is configured to allow the service principal 'ecs-tasks.amazonaws.com' to call 'sts:AssumeRole'.
Without this trust relationship, ECS cannot assign the role to the running task, resulting in authorization errors.
3
Attach a least-privilege IAM policy to the Task Role.
Create and attach an IAM policy that allows only the required actions ('sqs:ReceiveMessage' and 'dynamodb:PutItem') on the specific SQS queue and DynamoDB table resources.
This fulfills the authorization requirement while adhering to the security principle of least privilege.

Anahtar Kavram

ECS Task Role vs. ECS Task Execution Role and IAM Trust Policies
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru