DOP-C02 · Question #462
A company uses Amazon ECS with the Amazon EC2 launch type. The company requires all log data to be centralized on Amazon CloudWatch. The company's ECS tasks failed to deploy. An error message…
The correct answer is A. Add an IAM trust policy to the IAM role that establishes Amazon ECS as a trusted service. ECS container instances must have an IAM role that trusts ECS (the ecs-tasks.amazonaws.com principal) to assume permissions for CloudWatch logging. Without this trust relationship, ECS cannot push logs even if the permissions are present.
Question
A company uses Amazon ECS with the Amazon EC2 launch type. The company requires all log data to be centralized on Amazon CloudWatch. The company's ECS tasks failed to deploy. An error message indicates that a missing permission causes the failure. The IAM role used includes logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Which solution will fix the problem?
Options
- AAdd an IAM trust policy to the IAM role that establishes Amazon ECS as a trusted service.
- BAdd the logs:PutDestination permission.
- CRemove the logs:CreateLogStream permission.
- DAdd an IAM trust policy that establishes CloudWatch as a trusted service.
How the community answered
(31 responses)- A94% (29)
- B3% (1)
- C3% (1)
Explanation
ECS container instances must have an IAM role that trusts ECS (the ecs-tasks.amazonaws.com principal) to assume permissions for CloudWatch logging. Without this trust relationship, ECS cannot push logs even if the permissions are present.
Topics
Community Discussion
No community discussion yet for this question.