Examkin

Soru

Zorluk: OrtaAmazon ECS and Docker Deployment

A developer is deploying a containerized API application to Amazon ECS on AWS Fargate. The container needs to send its application logs to Amazon CloudWatch Logs using the awslogs log driver. Additionally, the application code itself needs to store uploaded user profile images in an Amazon S3 bucket. How should the developer configure the IAM roles in the task definition to satisfy these requirements?

  1. A
    Associate an IAM role containing both Amazon S3 write and CloudWatch Logs write permissions as the Task Execution Role, and omit the Task Role.
  2. B
    Associate an IAM role with CloudWatch Logs write permissions as the Task Role, and associate an IAM role with Amazon S3 write permissions as the Task Execution Role.
  3. Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.Cevap
  4. D
    Associate an IAM role with Amazon S3 write permissions as the Task Role, and hardcode temporary AWS credentials for CloudWatch Logs write access within the container's environment variables.

Cevap

Associate an IAM role with Amazon S3 write permissions as the Task Role, and associate an IAM role with CloudWatch Logs write permissions as the Task Execution Role.
The correct answer correctly separates the roles: the Task Role provides AWS credentials to the application code running inside the container, granting access to Amazon S3. The Task Execution Role provides credentials to the Amazon ECS container agent, allowing it to write container logs to Amazon CloudWatch Logs.

Adım Adım Çözüm

1
Analyze the permission requirements for the containerized application.
The application code running inside the container requires access to Amazon S3, while the container agent requires access to Amazon CloudWatch Logs for logging.
This separates the security contexts of the application code versus the infrastructure/agent management.
2
Map the application code permissions to the appropriate ECS configuration parameter.
Assign the S3 access permissions to the Task Role.
The Task Role is designed to provide credentials to the containerized application code.
3
Map the ECS agent permissions to the appropriate ECS configuration parameter.
Assign the CloudWatch Logs write permissions to the Task Execution Role.
The Task Execution Role is designed to grant permissions to the Amazon ECS container agent to pull images and write logs.

Anahtar Kavram

ECS Task Role vs. ECS Task Execution Role
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Amazon ECS and Docker Deployment

Bu konudan daha fazla soru