Examkin

Soru

Zorluk: ZorAmazon ECS and Docker Deployment

An operations team is designing a secure privilege model for a containerized processing job running on Amazon ECS with the AWS Fargate launch type. The task definition specifies a single container built from a private Docker image in Amazon ECR. At launch, the container must have sensitive database credentials injected as environment variables from AWS Systems Manager Parameter Store using the container definition `secrets` parameter. During runtime, the application code inside the container must write processing events to an Amazon DynamoDB table and stream standard output to Amazon CloudWatch Logs. Which configuration will successfully run the container while adhering to the principle of least privilege?

  1. Configure an IAM task execution role with permissions for ECR image pull actions, CloudWatch log streaming actions, and SSM Parameter Store access. Configure a separate IAM task role with permissions for DynamoDB write actions. Set the trust policy of both roles to trust the `ecs-tasks.amazonaws.com` service principal.Cevap
  2. B
    Configure an IAM task role with permissions for ECR image pull actions, CloudWatch log streaming actions, SSM Parameter Store access, and DynamoDB write actions. Set the trust policy of this task role to trust the `ecs.amazonaws.com` service principal, and leave the task execution role unassigned.
  3. C
    Configure an IAM task execution role with permissions for DynamoDB write actions, ECR image pull actions, CloudWatch log streaming actions, and SSM Parameter Store access. Do not configure a task role, as the containerized application code automatically inherits the credentials of the task execution role.
  4. D
    Configure an IAM task execution role with permissions for ECR image pull actions, CloudWatch log streaming actions, and SSM Parameter Store access. Embed the AWS Access Key ID and Secret Access Key of a user with DynamoDB write permissions as environment variables in the Dockerfile to authenticate the application client.

Cevap

Configure an IAM task execution role with permissions for ECR, CloudWatch, and SSM Parameter Store, and configure an IAM task role with DynamoDB write permissions, ensuring both roles trust the ecs-tasks.amazonaws.com service principal.
The correct configuration assigns the ECS agent startup permissions (pulling the container image, setting up awslogs logging, and fetching secrets from SSM Parameter Store) to the Task Execution Role. The application runtime permissions (writing to DynamoDB) are assigned to the Task Role. Both roles must have a trust policy allowing the `ecs-tasks.amazonaws.com` service principal to assume them.

Adım Adım Çözüm

1
Determine the entity responsible for fetching container dependencies, pulling secrets via container definition properties, and setting up container log configuration.
The ECS host agent manages these lifecycle events before the container launches. Therefore, the ECR, CloudWatch, and Systems Manager Parameter Store permissions must be assigned to the ECS Task Execution Role.
Since AWS Fargate is a serverless host, the ECS agent requires these permissions to retrieve container resources and parameters on behalf of the customer.
2
Determine the entity responsible for the API calls made directly by the running application code.
The application code interacts with DynamoDB at runtime. These permissions must be assigned to the ECS Task Role.
The Task Role credentials are injected into the container's environment, allowing the AWS SDK inside the container to assume this role for application runtime calls.
3
Verify the IAM trust policy configuration required for the ECS tasks service.
Both the Task Role and Task Execution Role must trust the `ecs-tasks.amazonaws.com` service principal.
Using the wrong principal (such as `ecs.amazonaws.com`) will result in failures to assume the roles, as that principal belongs to the ECS service scheduler rather than the task execution agent.

Anahtar Kavram

Differentiating between the ECS Task Role (application runtime permissions) and the ECS Task Execution Role (ECS agent startup permissions), and configuring their trust policies.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru