Examkin

Soru

Zorluk: OrtaSecrets and Parameters Management

An organization runs a backend microservice on Amazon Elastic Container Service (Amazon ECS) using AWS Fargate. The container needs to access a third-party API key at startup. A SysOps administrator stores the API key as a SecureString parameter named /prod/payment/api_key in AWS Systems Manager Parameter Store, encrypted with a customer managed AWS KMS key. In the ECS task definition, the parameter is referenced in the container definition's secrets configuration. When Fargate attempts to launch the tasks, they fail to transition to the RUNNING state, displaying a resource provisioning error. Which actions should the SysOps administrator take to resolve this issue? (Select TWO.)

  1. Add the ssm:GetParameters permission to the ECS task execution IAM role.Cevap
  2. Grant the kms:Decrypt permission for the customer managed KMS key to the ECS task execution IAM role.Cevap
  3. C
    Add the ssm:GetParameters permission to the ECS task IAM role.
  4. D
    Grant the kms:Decrypt permission for the customer managed KMS key to the ECS task IAM role.
  5. E
    Modify the trust policy of the ECS task execution IAM role to trust the Systems Manager service principal (ssm.amazonaws.com).

Cevap

To resolve the container provisioning failure, the ECS task execution IAM role must be granted permissions to retrieve the parameter (ssm:GetParameters) and to decrypt the parameter using the KMS customer managed key (kms:Decrypt).
The correct actions involve configuring the ECS task execution IAM role. This role is assumed by the ECS agent to perform pre-run actions such as pulling images and fetching secrets. It needs the ssm:GetParameters action to read the parameter and the kms:Decrypt action on the KMS key used for the parameter's encryption to successfully decrypt the SecureString.

Adım Adım Çözüm

1
Identify the role responsible for retrieving secrets during ECS Fargate container provisioning.
The ECS task execution IAM role is identified as the role used by the ECS container agent to retrieve secrets and pull container images at startup, while the task role is used by application code after startup.
Distinguishing between these two roles ensures permissions are applied to the correct identity.
2
Update the IAM policy of the ECS task execution role.
The role is granted the ssm:GetParameters action targeting the ARN of the /prod/payment/api_key parameter.
This allows the ECS container agent to fetch the secret value from SSM Parameter Store.
3
Update the KMS key policy or attach an IAM policy allowing the ECS task execution role access to decrypt with the KMS key.
The role is granted the kms:Decrypt action targeting the customer managed KMS key used to encrypt the SecureString parameter.
SSM SecureString parameters require decryption at retrieval time, which fails if the calling execution role lacks decrypt permissions.

Anahtar Kavram

Distinction between the ECS task execution role and the ECS task role, and the necessary IAM and KMS permissions required for SSM Parameter Store SecureString decryption during container initialization.
Bu soruyu puanla

Konular

Secrets and Parameters Management

Bu konudan daha fazla soru