DVA-C02 Question 235
Select 3You are developing a microservices-based application and need to deploy your services as containers using Amazon ECS. You want to ensure that your container images are secure and follow best practices. Which of the following actions should you take? (Choose TWO)
- A
Use AWS Secrets Manager to inject sensitive data into containers at runtime instead of hardcoding them into the container image.
- B
Build container images with minimal base images to reduce the attack surface and potential vulnerabilities.
- C
Store container images in Amazon S3 to ensure high availability and scalability.
- D
Periodically scan container images stored in Amazon Elastic Container Registry (ECR) for vulnerabilities.
- E
Use the latest version of the application code and deploy it directly into the container runtime without a Dockerfile.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure secure and best-practice deployment of container images, you should use AWS Secrets Manager for injecting sensitive data, use minimal base images to reduce vulnerabilities, and scan container images for vulnerabilities using Amazon ECR. These actions help maintain a secure and maintainable containerized environment. Storing images in S3 and bypassing Dockerfiles are not aligned with AWS best practices for container image management.
- A. Correct.
Injecting sensitive data using AWS Secrets Manager is a best practice to secure secrets and avoid hardcoding them into the container image, which could lead to security vulnerabilities. This is correct.
- B. Correct.
Building minimal base images reduces the attack surface and the number of potential vulnerabilities in your container. This is a best practice for container security. This is correct.
- C. Incorrect.
Amazon S3 is not a recommended service for storing container images. The proper service for storing and managing container images is Amazon Elastic Container Registry (ECR). This is incorrect.
- D. Correct.
Amazon ECR offers a vulnerability scanning feature to identify potential security issues in container images. Scanning images periodically is a best practice for maintaining a secure container environment. This is correct.
- E. Incorrect.
Deploying application code directly into the container runtime without a Dockerfile is not a best practice. Dockerfiles allow you to define how the application and its dependencies are packaged, ensuring consistency and reproducibility. This is incorrect.