Task definitions in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Task Definition Components

Which part of an AWS ECS task definition specifies the Docker image to use for a container?

A taskRoleArn

B family

C executionRoleArn

D containerDefinitions.image

💡 Hint

Think about where you tell ECS what container to run.

The containerDefinitions section includes the image property that specifies the Docker image for the container.

❓ Configuration

intermediate

Task Definition JSON Validation

Given the following partial task definition snippet, which option correctly specifies the network mode? { "family": "my-task", "containerDefinitions": [ { "name": "app", "image": "myapp:latest", "memory": 512, "cpu": 256, "portMappings": [ {"containerPort": 80, "hostPort": 80} ] } ] } Options are possible values for "networkMode" to add at the root level.

A "networkMode": "bridge"

B "networkMode": "host"

C "networkMode": "none"

D "networkMode": "invalid"

💡 Hint

The default network mode for EC2 launch type is bridge.

The networkMode must be a valid value. 'bridge' is the default and valid for EC2 tasks with port mappings.

❓ Architecture

advanced

Task Definition and IAM Roles

Which IAM role should be specified in a task definition to allow the ECS agent to pull container images from a private ECR repository?

A executionRoleArn

B taskRoleArn

C serviceRoleArn

D instanceRoleArn

💡 Hint

This role is used by ECS to perform actions on your behalf during task startup.

The executionRoleArn grants permissions for ECS to pull images and manage logs during task startup.

❓ service_behavior

advanced

Effect of Task Definition Revision on Running Tasks

What happens to running ECS tasks when a new revision of a task definition is registered and a service is updated to use it?

A Existing tasks automatically update in place to the new revision.

B Existing tasks are immediately stopped and replaced by new tasks.

C Existing tasks continue running until replaced by new tasks with the new revision.

D Existing tasks run both old and new revisions simultaneously without replacement.

💡 Hint

Consider how ECS handles rolling updates.

ECS launches new tasks with the new revision and stops old tasks according to deployment strategy; old tasks do not update in place.

❓ security

expert

Least Privilege Principle in Task Role Assignment

You want to allow your ECS task to access only a specific S3 bucket. Which approach best follows the least privilege principle when assigning IAM roles in the task definition?

A Use the default ECS task execution role with full S3 access.

B Create a taskRoleArn with a policy granting access only to the specific S3 bucket.

C Assign the EC2 instance role with S3 full access to the task.

D Do not assign any IAM role and rely on public bucket access.

💡 Hint

Think about granting only the permissions the task needs.

Assigning a taskRoleArn with a narrowly scoped policy limits permissions to only what the task requires, following least privilege.

Practice

1. What is the main purpose of an AWS ECS task definition?

easy

A. To specify how to run a containerized application including resources and settings

B. To create a virtual machine in AWS

C. To store data in AWS S3

D. To manage user permissions in AWS IAM

Solution

1. Step 1: Understand what a task definition is

   A task definition tells AWS ECS how to run your containerized app, including details like CPU, memory, and ports.

2. Step 2: Compare options to the definition

   Only To specify how to run a containerized application including resources and settings correctly describes this purpose. Other options describe unrelated AWS services.

3. Final Answer:

   To specify how to run a containerized application including resources and settings -> Option A

4. Quick Check:

   Task definition = container run instructions [OK]

Hint: Task definitions describe container setup and resources [OK]

Common Mistakes:

• Confusing task definitions with EC2 instances
• Thinking task definitions manage storage or permissions
• Mixing up ECS with other AWS services

2. Which of the following is the correct JSON snippet to define a container image in an ECS task definition?

easy

A. "docker_image": "myrepo/myapp:latest"

B. "image": "myrepo/myapp:latest"

C. "img": "myrepo/myapp:latest"

D. "container_image": "myrepo/myapp:latest"

Solution

1. Step 1: Recall ECS task definition JSON format

   The correct key for specifying the container image is "image" inside the container definitions.

2. Step 2: Check each option's key

   Only "image": "myrepo/myapp:latest" uses the correct key "image". Others use incorrect keys not recognized by ECS.

3. Final Answer:

   "image": "myrepo/myapp:latest" -> Option B

4. Quick Check:

   Container image key = "image" [OK]

Hint: Use "image" key exactly for container images in task definitions [OK]

Common Mistakes:

• Using incorrect keys like "container_image" or "img"
• Confusing task definition keys with Dockerfile syntax
• Misspelling the key name

3. Given this partial ECS task definition snippet:

{
  "containerDefinitions": [{
    "name": "web",
    "image": "nginx",
    "cpu": 256,
    "memory": 512,
    "portMappings": [{"containerPort": 80, "hostPort": 80}]
  }]
}

What will happen when this task runs?

medium

A. The container will use default CPU and memory values ignoring specified ones

B. The task will fail because hostPort cannot be 80

C. The container will run but without port 80 exposed

D. A container named 'web' runs nginx using 256 CPU units and 512 MB memory, exposing port 80

Solution

1. Step 1: Analyze container resource settings

   The task defines CPU as 256 units and memory as 512 MB, which are valid resource allocations.

2. Step 2: Check port mapping

   Port 80 is mapped from container to host, so port 80 is exposed correctly.

3. Final Answer:

   A container named 'web' runs nginx using 256 CPU units and 512 MB memory, exposing port 80 -> Option D

4. Quick Check:

   Resources and ports set correctly = runs as expected [OK]

Hint: Port mappings expose container ports to host ports directly [OK]

Common Mistakes:

• Assuming hostPort 80 is invalid (it is allowed)
• Ignoring resource settings and thinking defaults apply
• Missing port exposure due to misunderstanding portMappings

4. You have this ECS task definition snippet:

{
  "containerDefinitions": [{
    "name": "app",
    "image": "myapp:latest",
    "cpu": 512,
    "memory": 1024
  }]
}

When you try to run this task, it fails with an error about missing port mappings. What is the likely fix?

medium

A. Add a portMappings section specifying containerPort and hostPort

B. Remove the cpu and memory fields

C. Change the image name to include a registry URL

D. Rename the container from 'app' to 'web'

Solution

1. Step 1: Understand the error about missing port mappings

   If the app requires network access, port mappings must be defined to expose ports.

2. Step 2: Identify the fix

   Adding a portMappings section with containerPort and hostPort will resolve the error by exposing the needed ports.

3. Final Answer:

   Add a portMappings section specifying containerPort and hostPort -> Option A

4. Quick Check:

   Missing ports error = add portMappings [OK]

Hint: Add portMappings to expose container ports when needed [OK]

Common Mistakes:

• Removing CPU or memory which are unrelated to port errors
• Changing image name unnecessarily
• Renaming container without fixing ports

5. You want to update your ECS service to run a new version of your app with environment variables and increased memory. Which part of the task definition should you modify?

hard

A. Change the taskRoleArn to a new IAM role

B. Modify the family name of the task definition

C. Update the containerDefinitions section to include new environment variables and increase the memory value

D. Add a new volume definition without changing container settings

Solution

1. Step 1: Identify where environment variables and memory are set

   Environment variables and memory limits are set inside the containerDefinitions section of the task definition.

2. Step 2: Understand the update process

   To update the app version and resources, modify containerDefinitions with new environment variables and increased memory.

3. Final Answer:

   Update the containerDefinitions section to include new environment variables and increase the memory value -> Option C

4. Quick Check:

   Env vars and memory updated in containerDefinitions [OK]

Hint: Change containerDefinitions to update app settings and resources [OK]

Common Mistakes:

• Changing taskRoleArn which controls permissions, not env or memory
• Modifying family name which identifies task definition versions
• Adding volumes without updating container environment or memory