DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The task execution role does not have permission to retrieve the secret.

  Why it's wrong here

  The ECS Task Execution Role is primarily responsible for actions the ECS agent performs on behalf of the task, such as pulling container images from ECR, publishing container logs to CloudWatch, and managing network interfaces. It is distinct from the Task Role, which is assumed by the application inside the container to make AWS API calls, including retrieving secrets from AWS Secrets Manager at runtime. Therefore, a lack of secret retrieval permissions on the Task Execution Role would not prevent the application itself from accessing the secret.

• ✓

  The secret's resource-based policy denies access to the task role.

  Why this is correct

  AWS Secrets Manager supports resource-based policies, which are attached directly to the secret itself and specify which principals (like an ECS Task Role) are allowed or denied access. Even if the ECS Task Role has an identity-based policy that explicitly grants permission to retrieve secrets, an explicit Deny statement in the secret's resource-based policy will always override any Allow statements, effectively blocking access for the task role. This provides a powerful mechanism for fine-grained access control at the resource level.

• ✗

  The task is in a private subnet without a VPC endpoint to Secrets Manager.

  Why it's wrong here

  While an ECS task running in a private subnet requires a network path to reach AWS Secrets Manager, the absence of a VPC endpoint for Secrets Manager does not automatically mean no connectivity. Tasks in a private subnet can still access public AWS service endpoints if a NAT Gateway is configured in a public subnet and the private subnet's route table is correctly configured to route outbound internet traffic through it. Therefore, simply lacking a VPC endpoint is not a definitive cause for failure if a NAT Gateway provides an alternative path.

• ✗

  The secret name does not match the pattern in the policy.

  Why it's wrong here

  AWS IAM policies and resource-based policies often utilize wildcards in resource ARNs to grant permissions to a group of resources. If a policy's resource ARN pattern, such as arn:aws:secretsmanager:region:account:secret:my-app-secret-*, is designed to match secrets starting with "my-app-secret-", and the actual secret name adheres to this pattern, then the policy would apply. Therefore, the issue is not a mismatch in the secret name against the policy's pattern if the wildcard correctly encompasses the secret.

Go deeper

Related to this question