DVA-C02 Security Practice Question
A developer is deploying a containerized application on Amazon ECS with the Fargate launch type. The application needs to read data from an Amazon S3 bucket. The developer wants to follow the principle of least privilege. How should the developer grant the necessary permissions to the ECS tasks?
⚠ Common exam trap
A common mix-up: candidates confuse IAM roles with IAM users or think that network-level controls like security groups can be used for S3 access, but AWS S3 does not evaluate security groups for authorization; only IAM policies and bucket policies are evaluated.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM task role and reference it in the task definition using the 'taskRoleArn' parameter.
Amazon ECS with the Fargate launch type supports IAM task roles, which allow you to assign an IAM role to the ECS task itself. By referencing the IAM task role in the task definition using the 'taskRoleArn' parameter, the containerized application can securely obtain temporary credentials from the ECS container agent via the AWS STS service, adhering to the principle of least privilege without embedding long-lived credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store AWS access keys as environment variables in the task definition.
Why it's wrong here
Storing AWS access keys as environment variables in the task definition is a highly insecure practice. These credentials are easily accessible to anyone with `docker inspect` permissions on the host or if the task definition is viewed directly. They can also inadvertently appear in application logs, making them vulnerable to exposure. This method complicates credential rotation and makes it difficult to enforce the principle of least privilege, directly violating secure credential management best practices.
- ✓
Create an IAM task role and reference it in the task definition using the 'taskRoleArn' parameter.
Why this is correct
Creating an IAM task role and referencing it via the 'taskRoleArn' parameter in the task definition is the recommended and most secure method for granting AWS permissions to containers. ECS automatically injects temporary, frequently rotated credentials into the container's metadata service. This allows applications using the AWS SDK to seamlessly assume the role and access AWS resources without hardcoding any credentials, adhering to the principle of least privilege and secure credential management.
- ✗
Create an IAM user and embed its credentials in the container image.
Why it's wrong here
Embedding static IAM user credentials directly within a container image is a severe security vulnerability. Once built into the image, these credentials are fixed and distributed with every image copy, making rotation extremely difficult and requiring a full image rebuild and redeployment. This practice also grants persistent, potentially overly broad permissions to the container, directly contravening the principle of least privilege and secure credential handling.
- ✗
Use an S3 bucket policy that grants access based on the security group of the ECS tasks.
Why it's wrong here
S3 bucket policies define access permissions based on IAM principals (users, roles, accounts) or IP addresses, not network-level constructs like security groups. While security groups control network traffic to and from ECS tasks, they cannot be specified as a `Principal` element in an S3 bucket policy. Therefore, this approach is fundamentally incompatible with how S3 bucket policies are structured and enforced for resource access.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is deploying a web application on Amazon ECS with a Fargate launch type. The application needs to securely access an Amazon DynamoDB table. How should the developer grant permissions?
medium- A.Store AWS credentials in the container image
- ✓ B.Define a task role for the ECS task with DynamoDB permissions
- C.Assign an IAM role to the ECS service and use it from the container
- D.Use an EC2 instance profile and mount it to the container
Why B: For ECS tasks with Fargate, you define a task execution role and a task role. The task role grants permissions to the containers to access AWS services like DynamoDB.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.