SAA-C03 · Question #400
A company runs an application as a task in an Amazon Elastic Container Service (Amazon ECS) cluster. The application must have read and write access to a specific group of Amazon S3 buckets. The S3 bu
The correct answer is B. Create an IAM policy that lists the full Amazon Resource Name (ARN) for each S3 bucket. E. Attach the IAM policy to the task role of the ECS task.. To grant the ECS application the least privilege, you create an IAM policy that explicitly lists the ARNs of the specific S3 buckets the task should access. You then attach this policy to the task role (not the instance role), ensuring only that task has the necessary permissions
Question
A company runs an application as a task in an Amazon Elastic Container Service (Amazon ECS) cluster. The application must have read and write access to a specific group of Amazon S3 buckets. The S3 buckets are in the same AWS Region and AWS account as the ECS cluster. The company needs to grant the application access to the S3 buckets according to the principle of least privilege. Which combination of solutions will meet these requirements? (Select TWO.)
Options
- AAdd a tag to each bucket. Create an IAM policy that includes a StringEquals condition that
- BCreate an IAM policy that lists the full Amazon Resource Name (ARN) for each S3 bucket.
- CAttach the IAM policy to the instance role of the ECS task.
- DCreate an IAM policy that includes a wildcard Amazon Resource Name (ARN) that matches all
- EAttach the IAM policy to the task role of the ECS task.
How the community answered
(40 responses)- A5% (2)
- B85% (34)
- C8% (3)
- D3% (1)
Explanation
To grant the ECS application the least privilege, you create an IAM policy that explicitly lists the ARNs of the specific S3 buckets the task should access. You then attach this policy to the task role (not the instance role), ensuring only that task has the necessary permissions. This approach avoids granting permissions to other EC2 instances or services and restricts access strictly to the required buckets.
Community Discussion
No community discussion yet for this question.