Examkin

Soru

Zorluk: OrtaIAM Policies and Roles

A developer is deploying a microservice as an Amazon ECS task on AWS Fargate. The microservice needs to read configuration files from an Amazon S3 bucket. The developer creates an IAM role with the necessary S3 permissions and associates it with the ECS Task Definition as the `taskRoleArn`. However, when the container starts, the application logs show an error indicating that the task is unable to retrieve temporary credentials to access Amazon S3.

The trust policy currently configured on the IAM role is as follows:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Principal": {
"Service": "ecs.amazonaws.com"
},
"Action": "sts:AssumeRole"
}
]
}

Which modification to the IAM role configuration will resolve this issue?

  1. A
    Add the `s3:GetObject` action and the S3 bucket ARN directly to the trust policy statements.
  2. B
    Remove the trust policy and hardcode a set of long-term AWS access keys with S3 permissions directly into the application's SDK client configuration.
  3. Change the principal service in the trust policy to `ecs-tasks.amazonaws.com`.Cevap
  4. D
    Change the trust policy action to `sts:AssumeRoleWithWebIdentity` to allow container-level authentication.

Cevap

Change the principal service in the trust policy to `ecs-tasks.amazonaws.com`.
The correct action is to change the principal service in the trust policy to `ecs-tasks.amazonaws.com`. In Amazon ECS, when running tasks on Fargate or EC2, the Amazon ECS container agent makes the call to assume the IAM role defined as `taskRoleArn` on behalf of the container. The service principal representing these ECS tasks is `ecs-tasks.amazonaws.com`. Using `ecs.amazonaws.com` is incorrect because it represents the core Amazon ECS service scheduler itself (used for registering container instances or updating service status), which does not have permission to assume the task role.

Adım Adım Çözüm

1
Identify the entity attempting to assume the IAM role.
The application is running as an Amazon ECS task.
We must verify the correct service principal required by the runtime environment.
2
Check the service principal specified in the trust policy.
The current trust policy specifies `ecs.amazonaws.com`.
We need to ensure that the correct service is authorized to assume the role.
3
Modify the service principal to match the ECS task runtime service.
Update the trust policy's Principal Service to `ecs-tasks.amazonaws.com`.
This allows the ECS task container agent to retrieve temporary security credentials for S3 access.

Anahtar Kavram

IAM Role Trust Policy Service Principals
Bu soruyu puanla

Konular

IAM Policies and Roles

Bu konudan daha fazla soru