SAP-C02 · Question #160
A fleet of Amazon ECS instances is used to poll an Amazon SQS queue and update items in an Amazon DynamoDB database. Items in the table are not being updated, and the SQS queue is filling up. Amazon C
The correct answer is D. The ECS task role was modified.. Consistent 400 errors from DynamoDB when ECS tasks attempt updates, despite adequate write capacity and no throttling, strongly indicates that the ECS task role lacks the necessary IAM permissions to perform DynamoDB write operations.
Question
A fleet of Amazon ECS instances is used to poll an Amazon SQS queue and update items in an Amazon DynamoDB database. Items in the table are not being updated, and the SQS queue is filling up. Amazon CloudWatch Logs are showing consistent 400 errors when attempting to update the table. The provisioned write capacity units are appropriately configured, and no throttling is occurring. What is the LIKELY cause of the failure?
Options
- AThe ECS service was deleted.
- BThe ECS configuration does not contain an Auto Scaling group.
- CThe ECS instance task execution IAM role was modified.
- DThe ECS task role was modified.
How the community answered
(53 responses)- A2% (1)
- B8% (4)
- C13% (7)
- D77% (41)
Why each option
Consistent 400 errors from DynamoDB when ECS tasks attempt updates, despite adequate write capacity and no throttling, strongly indicates that the ECS task role lacks the necessary IAM permissions to perform DynamoDB write operations.
If the ECS service was deleted, no tasks would be running, and thus no attempts to update DynamoDB would occur, nor would the SQS queue fill up from messages being polled but not processed.
The absence of an Auto Scaling group affects the scalability and availability of ECS instances but does not cause individual ECS tasks to receive 400 permission errors when attempting to interact with DynamoDB.
The ECS instance task execution IAM role is used by the ECS agent for operations like registering instances, pulling images, and logging, not by the application containers for calling other AWS services like DynamoDB; that is the function of the task role.
The ECS task role grants permissions to the application containers running within an ECS task to make AWS API calls, such as updating DynamoDB. If this role was modified or misconfigured, tasks would receive 400 'Access Denied' errors when trying to write to DynamoDB.
Concept tested: AWS ECS IAM task roles and DynamoDB permissions
Source: https://docs.aws.amazon.com/AmazonECS/latest/developerguide/task-iam-roles.html
Community Discussion
No community discussion yet for this question.