Examkin

Soru

Zorluk: OrtaAmazon ECS and Docker Deployment

A developer is deploying a containerized microservice to Amazon ECS using the AWS Fargate launch type. The application requires sensitive database credentials to be injected into the container as environment variables at startup from AWS Systems Manager Parameter Store. Additionally, the application must send its container logs to Amazon CloudWatch Logs using the awslogs log driver. Which configuration steps must the developer perform to establish the required IAM roles and permissions for this deployment? (Select TWO.)

  1. Configure the ECS task execution role with permissions to read the SSM parameters, decrypt the values using AWS KMS, and create/write log streams in CloudWatch Logs.Cevap
  2. Configure the trust policy of the ECS task execution role to allow the ecs-tasks.amazonaws.com service principal to assume the role.Cevap
  3. C
    Configure the ECS task role with permissions to retrieve the SSM parameters and write logs to CloudWatch Logs.
  4. D
    Configure the trust policy of the ECS task execution role to allow the ec2.amazonaws.com service principal to assume the role.
  5. E
    Initialize the AWS SDK client within the application code using hardcoded IAM access keys to retrieve the database credentials at runtime.

Cevap

Configure the ECS task execution role with permissions to read the SSM parameters, decrypt the values using AWS KMS, and create/write log streams in CloudWatch Logs, and configure the trust policy of the ECS task execution role to allow the ecs-tasks.amazonaws.com service principal to assume the role.
The correct options state that the ECS task execution role must be configured with permissions to access SSM Parameter Store, decrypt the secrets using KMS, and write logs to CloudWatch, and that the trust policy must allow ecs-tasks.amazonaws.com to assume the role. The ECS container agent runs outside the application container to set up logs and pull secrets, meaning it relies on the task execution role, which must trust the ECS service principal.

Adım Adım Çözüm

1
Identify the agent responsible for pulling secrets and setting up logging.
The ECS container agent (not the application code) performs these pre-startup actions, which means the ECS task execution role is required instead of the ECS task role.
Correctly segregating container initialization permissions from application runtime permissions is required by ECS.
2
Grant specific resource access permissions to the task execution role.
The task execution role receives permissions to read SSM parameters, decrypt KMS keys, and create/write logs in CloudWatch.
This enables the ECS agent to retrieve credentials from Parameter Store and direct container logs to CloudWatch.
3
Configure the trust relationship for the task execution role.
The role's trust policy is updated to allow the ecs-tasks.amazonaws.com service principal to assume the role.
ECS tasks cannot assume IAM roles unless the ECS service principal is explicitly trusted.

Anahtar Kavram

Differentiating between the ECS Task Role and the ECS Task Execution Role, and configuring the correct trust relationships and policies.
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru