nerdexam
Amazon

DOP-C02 · Question #482

A company uses Amazon Elastic Container Service (Amazon ECS) with an Amazon EC2 launch type. The company requires all log data to be centralized on Amazon CloudWatch. The company's ECS tasks include…

The correct answer is A. Add an IAM trust policy to the IAM role that establishes Amazon ECS as a trusted service. For ECS tasks using the awslogs driver, the ECS Task Execution IAM role must have a trust policy allowing ecs-tasks.amazonaws.com to assume it for successful deployment and log delivery.

Submitted by andreas_gr· Mar 6, 2026Monitoring and Logging

Question

A company uses Amazon Elastic Container Service (Amazon ECS) with an Amazon EC2 launch type. The company requires all log data to be centralized on Amazon CloudWatch. The company's ECS tasks include a LogConfiguration object that specifies a value of awslogs for the log driver name. The company's ECS tasks failed to deploy. An error message indicates that a missing permission causes the failure. The company confirmed that the IAM role used to launch container instances includes the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents permissions. Which solution will fix the problem?

Options

  • AAdd an IAM trust policy to the IAM role that establishes Amazon ECS as a trusted service.
  • BAdd the logs:PutDestination permission to the policy applied to the IAM role.
  • CRemove the logs:CreateLogStream permission from the policy applied to the IAM role.
  • DAdd an IAM trust policy to the IAM role that establishes CloudWatch as a trusted service.

How the community answered

(38 responses)
  • A
    79% (30)
  • B
    8% (3)
  • C
    3% (1)
  • D
    11% (4)

Why each option

For ECS tasks using the `awslogs` driver, the ECS Task Execution IAM role must have a trust policy allowing `ecs-tasks.amazonaws.com` to assume it for successful deployment and log delivery.

AAdd an IAM trust policy to the IAM role that establishes Amazon ECS as a trusted service.Correct

The Amazon ECS Task Execution IAM role, which is used by the ECS agent to perform actions like creating CloudWatch Log groups and streams for the `awslogs` driver, must have a trust policy that permits the `ecs-tasks.amazonaws.com` service principal to assume the role. Without this trust policy, the ECS service cannot assume the role to perform the necessary logging actions, leading to task deployment failures even if the role itself has the appropriate `logs:` permissions.

BAdd the logs:PutDestination permission to the policy applied to the IAM role.

The `logs:PutDestination` permission is used for configuring subscription filter destinations in CloudWatch Logs, which is not required for an ECS task to simply send its own logs to a log group using the `awslogs` driver.

CRemove the logs:CreateLogStream permission from the policy applied to the IAM role.

Removing the `logs:CreateLogStream` permission would prevent the `awslogs` driver from creating new log streams, which is necessary for log delivery and would exacerbate, not fix, a logging problem.

DAdd an IAM trust policy to the IAM role that establishes CloudWatch as a trusted service.

CloudWatch is a logging and monitoring service and does not assume IAM roles for ECS task execution or log delivery; the `ecs-tasks.amazonaws.com` service principal is the entity that needs to be trusted by the Task Execution Role.

Concept tested: ECS Task Execution Role trust policy

Source: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task_execution_IAM_role.html

Topics

#ECS#IAM Roles#CloudWatch Logs#Trust Policies

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DOP-C02 Practice