Examkin

Soru

Zorluk: KolayResolving IAM and Authorization Failures

An application container deployed on Amazon ECS tasks is designed to read encrypted objects from an Amazon S3 bucket. The objects are encrypted using an AWS KMS customer managed key. During execution, the application receives an 'Access Denied' error when trying to retrieve and decrypt the files. Which two configurations should the developer verify or modify to resolve this authorization failure? (Select TWO.)

  1. Add s3:GetObject and kms:Decrypt permissions to the IAM policy attached to the ECS Task Role.Cevap
  2. Update the AWS KMS key policy to permit the ECS Task Role to perform the kms:Decrypt action.Cevap
  3. C
    Add s3:GetObject and kms:Decrypt permissions to the IAM policy attached to the ECS Task Execution Role.
  4. D
    Grant the ECS Task Execution Role permissions to read the objects in the S3 bucket policy.
  5. E
    Modify the trust policy of the ECS Task Role to allow the AWS Key Management Service (KMS) principal to assume the role.

Cevap

Attach an IAM policy to the ECS Task Role granting s3:GetObject and kms:Decrypt permissions, and ensure the KMS key policy allows the ECS Task Role to execute the kms:Decrypt action.
The correct configuration requires identifying that the application running inside the container uses the ECS Task Role for accessing AWS services. Since the objects in the S3 bucket are encrypted with a customer managed KMS key, the Task Role needs permissions for both reading from S3 and decrypting with the KMS key. Additionally, the key policy of the customer managed key must be updated to allow the Task Role to perform the decryption operation, as KMS key policies must explicitly allow access to IAM roles.

Adım Adım Çözüm

1
Distinguish between the ECS Task Role and the ECS Task Execution Role.
Identify that the application code running inside the container uses the ECS Task Role to access AWS resources, while the ECS agent uses the Task Execution Role.
This prevents assigning application permissions to the wrong role.
2
Configure permissions for the S3 and KMS actions on the ECS Task Role.
Apply an IAM policy to the Task Role that includes s3:GetObject and kms:Decrypt permissions.
The application needs identity-based permissions to read the S3 objects and decrypt them using the custom key.
3
Ensure the KMS key policy delegates access to the ECS Task Role.
Update the KMS key policy of the customer managed key to allow the Task Role's ARN to call kms:Decrypt.
Unlike AWS managed keys, customer managed KMS keys require the key policy to explicitly authorize the IAM role.

Anahtar Kavram

Resolving authorization issues when accessing KMS-encrypted S3 resources from ECS tasks requires distinguishing between ECS Task Roles and Task Execution Roles, and ensuring both IAM identity policies and KMS key policies permit the action.
Bu soruyu puanla

Konular

Resolving IAM and Authorization Failures

Bu konudan daha fazla soru