SAP-C02 Question 660
Single answerA company runs a containerized application using Amazon ECS on Fargate. The application needs to securely access sensitive credentials stored in AWS Secrets Manager. How can you configure the ECS tasks to retrieve the secrets without exposing them directly in the application code?
- A
Attach an IAM role to the ECS task with permissions to access the secrets, and specify the secret in the ECS task definition.
- B
Use an environment variable in the ECS task definition to store the secret's plaintext value.
- C
Manually retrieve the secret value from Secrets Manager and inject it into the container at runtime.
- D
Mount a file system to the ECS task that contains the secret values.
Show answer and explanation
Correct answer: A
Explanation
The recommended way to allow ECS tasks to securely access secrets from AWS Secrets Manager is by attaching an IAM role to the ECS task with the appropriate permissions. The secret can then be specified in the ECS task definition, enabling the application to securely retrieve the secret value at runtime. This approach ensures security and aligns with AWS best practices.
- A. Correct.
Correct. Attaching an IAM role to the ECS task and specifying the secret in the ECS task definition allows the container to securely retrieve the secret from Secrets Manager without exposing it in plaintext.
- B. Incorrect.
Incorrect. Storing the secret's plaintext value in an environment variable is insecure and violates best practices for handling sensitive information.
- C. Incorrect.
Incorrect. Manually retrieving and injecting the secret into the container increases operational complexity and is not an automated or secure approach.
- D. Incorrect.
Incorrect. Mounting a file system to the ECS task is not a supported or recommended method for securely accessing secrets in ECS.