Task definitions in AWS - Practice Problems & Coding Challenges

Challenge - 5 Problems

🧠 Conceptual

intermediate

Understanding Task Definition Components

Which part of an AWS ECS task definition specifies the Docker image to use for a container?

A taskRoleArn

B family

C executionRoleArn

D containerDefinitions.image

💡 Hint

Think about where you tell ECS what container to run.

The containerDefinitions section includes the image property that specifies the Docker image for the container.

❓ Configuration

intermediate

Task Definition JSON Validation

Given the following partial task definition snippet, which option correctly specifies the network mode? { "family": "my-task", "containerDefinitions": [ { "name": "app", "image": "myapp:latest", "memory": 512, "cpu": 256, "portMappings": [ {"containerPort": 80, "hostPort": 80} ] } ] } Options are possible values for "networkMode" to add at the root level.

A "networkMode": "bridge"

B "networkMode": "host"

C "networkMode": "none"

D "networkMode": "invalid"

💡 Hint

The default network mode for EC2 launch type is bridge.

The networkMode must be a valid value. 'bridge' is the default and valid for EC2 tasks with port mappings.

❓ Architecture

advanced

Task Definition and IAM Roles

Which IAM role should be specified in a task definition to allow the ECS agent to pull container images from a private ECR repository?

A executionRoleArn

B taskRoleArn

C serviceRoleArn

D instanceRoleArn

💡 Hint

This role is used by ECS to perform actions on your behalf during task startup.

The executionRoleArn grants permissions for ECS to pull images and manage logs during task startup.

❓ service_behavior

advanced

Effect of Task Definition Revision on Running Tasks

What happens to running ECS tasks when a new revision of a task definition is registered and a service is updated to use it?

A Existing tasks automatically update in place to the new revision.

B Existing tasks are immediately stopped and replaced by new tasks.

C Existing tasks continue running until replaced by new tasks with the new revision.

D Existing tasks run both old and new revisions simultaneously without replacement.

💡 Hint

Consider how ECS handles rolling updates.

ECS launches new tasks with the new revision and stops old tasks according to deployment strategy; old tasks do not update in place.

❓ security

expert

Least Privilege Principle in Task Role Assignment

You want to allow your ECS task to access only a specific S3 bucket. Which approach best follows the least privilege principle when assigning IAM roles in the task definition?

A Use the default ECS task execution role with full S3 access.

B Create a taskRoleArn with a policy granting access only to the specific S3 bucket.

C Assign the EC2 instance role with S3 full access to the task.

D Do not assign any IAM role and rely on public bucket access.

💡 Hint

Think about granting only the permissions the task needs.

Assigning a taskRoleArn with a narrowly scoped policy limits permissions to only what the task requires, following least privilege.