Two containerized microservices run on Amazon ECS on EC2 instances. Service A reads from an Amazon Aurora (RDS) database; Service B reads from a DynamoDB table. How can you grant each microservice the minimum required privileges?
Choose an answer
Tap an option to check your answer.
Correct answer: Set ECS_ENABLE_TASK_IAM_ROLE to true in the ECS agent configuration when the EC2 instance boots. Run Service A using an IAM task role that has read-only access to the Aurora database. Run Service B using an IAM task role that has read-only access to DynamoDB..
Why this is the answer
The correct option utilizes IAM task roles, which is the recommended and most granular way to grant permissions to individual tasks in Amazon ECS. By setting ECSENABLETASKIAMROLE to true, you enable the use of task-specific IAM roles. This allows Service A to have a role with read-only access to Aurora and Service B to have a separate role with read-only access to DynamoDB, adhering to the principle of least privilege.
The incorrect options either disable task IAM roles (forcing all tasks to use the EC2 instance profile, which violates least privilege if different tasks need different permissions) or incorrectly suggest granting broad permissions to the EC2 instance profile when task roles are enabled, which is not the best practice for individual task-level permissions.