Security Engineering on AWS Certification Container & Serverless Security 2 — Questions and Answers
Question 1: In Amazon ECS, what is the security distinction between an ECS task execution role and an ECS task role?
- The execution role is used by the running application; the task role is used by the ECS agent to pull images and write logs
- The task execution role is used by the ECS agent to pull images and write logs; the task role is assumed by the application code inside the container (Correct answer)
- Both roles serve identical purposes and are interchangeable
- The task role is only used with Fargate launch type; the execution role is only for EC2 launch type
Correct answer: The task execution role is used by the ECS agent to pull images and write logs; the task role is assumed by the application code inside the container
The task execution role grants permissions to the ECS infrastructure agent (e.g., pulling images from ECR, writing to CloudWatch Logs), while the task role grants permissions to the containerized application itself.
Question 2: Which Lambda resource-based policy configuration restricts invocation of a function to only a specific AWS account and service?
- An IAM identity-based policy attached to the caller
- A Lambda function resource policy with a Principal specifying the trusted account and service (Correct answer)
- An S3 bucket policy on the function's deployment package
- A VPC security group allowing inbound TCP 443
Correct answer: A Lambda function resource policy with a Principal specifying the trusted account and service
Lambda resource-based policies (function policies) specify which principals—accounts, services, or ARNs—are permitted to invoke the function, providing a cross-account authorization boundary.
Question 3: Which AWS feature should you enable on an Amazon ECR repository to prevent mutable image tags from being overwritten, reducing supply chain attack risk?
- ECR cross-region replication
- ECR image tag immutability (Correct answer)
- ECR repository policy
- ECR pull-through cache
Correct answer: ECR image tag immutability
Enabling image tag immutability on an ECR repository prevents existing tags from being reassigned to different image digests, ensuring that a tag always refers to the same verified image.
Question 4: How does enabling VPC configuration for a Lambda function improve security?
- It grants the function access to the public internet by default
- It allows the function to access private resources in a VPC such as RDS databases or internal endpoints without exposing them publicly (Correct answer)
- It automatically encrypts all function environment variables
- It prevents the function from being invoked from outside the VPC
Correct answer: It allows the function to access private resources in a VPC such as RDS databases or internal endpoints without exposing them publicly
Placing a Lambda function in a VPC enables it to reach private resources (RDS, ElastiCache, internal APIs) via private IP without those resources needing public endpoints.
Question 5: An ECS container needs to access AWS services. Which method is considered a security best practice for providing AWS credentials?
- Embed access key ID and secret access key in the Dockerfile as environment variables
- Store credentials in an S3 object and copy them into the container at startup
- Use an ECS task role so temporary credentials are automatically provided via the container metadata endpoint (Correct answer)
- Hardcode credentials in the application source code and rebuild on rotation
Correct answer: Use an ECS task role so temporary credentials are automatically provided via the container metadata endpoint
ECS task roles deliver short-lived, automatically rotated credentials via the container credential provider endpoint, eliminating the need to manage static long-term access keys.
Question 6: Which AWS service or feature provides a private network endpoint for pulling container images from Amazon ECR without routing traffic through the public internet?
- AWS Direct Connect
- ECR VPC interface endpoint (AWS PrivateLink) (Correct answer)
- ECR cross-region replication
- AWS Transit Gateway
Correct answer: ECR VPC interface endpoint (AWS PrivateLink)
An ECR VPC interface endpoint powered by AWS PrivateLink allows ECS/EKS workloads in a VPC to pull images from ECR over the private AWS network, eliminating internet exposure.
Question 7: When using Lambda Layers to share code across functions, which security concern must be explicitly managed?
- Layers automatically grant public access to all functions in the account
- A layer can be shared across accounts, so layer resource policies must restrict which accounts and principals can use the layer (Correct answer)
- Lambda Layers cannot be versioned, making security patching impossible
- Layers are stored in EBS volumes which require separate encryption keys
Correct answer: A layer can be shared across accounts, so layer resource policies must restrict which accounts and principals can use the layer
Lambda Layers support resource-based policies that control cross-account sharing; without explicit restrictions, a published layer could be accessed by unintended AWS accounts.
Security Engineering on AWS Certification Container & Serverless Security 2
In Amazon ECS, what is the security distinction between an ECS task execution role and an ECS task role?