DVA-C02 Question 359
Single answerA developer is deploying an application on Amazon ECS using the Fargate launch type. The application needs to access objects stored in a private Amazon S3 bucket. How can the developer ensure the application has the necessary permissions to access the S3 bucket without embedding credentials in the application code?
- A
Attach an IAM role to the ECS task definition that grants access to the S3 bucket
- B
Store the access key and secret key in the application code to authenticate with the S3 bucket
- C
Create an IAM user with permissions to access the S3 bucket and pass its credentials to the ECS task definition
- D
Use a VPC endpoint to connect to the S3 bucket without requiring any IAM permissions
Show answer and explanation
Correct answer: A
Explanation
The correct approach to securely grant an ECS task in Fargate access to a private S3 bucket is to attach an IAM role with the necessary permissions to the ECS task definition. This prevents the need to hardcode credentials, follows AWS security best practices, and ensures tasks can securely access AWS services.
- A. Correct.
This is the best practice for granting permissions to ECS tasks in Fargate. By attaching an IAM role to the ECS task definition, tasks can securely access AWS resources like S3 without hardcoding credentials.
- B. Incorrect.
Embedding credentials in the application code is not recommended due to significant security risks. This approach violates AWS security best practices.
- C. Incorrect.
IAM user credentials are not designed for use with ECS tasks. This approach is insecure and not scalable, as it requires manual management of user credentials.
- D. Incorrect.
A VPC endpoint allows private connectivity to S3 within a VPC but does not provide permissions or replace the need for IAM roles.