A payments team runs an API as an Amazon ECS service on AWS Fargate. A bug appears only in production, and a developer needs a shell inside one running container to inspect files and test network calls.
The security team does not allow SSH servers in images or inbound ports opened for debugging. Every command run in a container must be logged for audit.
Which approach meets these requirements?
Choose one answer.
AA. Turn on ECS Exec with a new deployment, grant the task role the ssmmessages permissions, and set command logging in the cluster's configuration.
BB. Add an OpenSSH server to the image, allow port 22 in the task's security group only from the office IP range, and connect with a key pair.
CC. Turn on ECS Exec for the service, then run aws ecs execute-command against the tasks that are already running, without starting a new deployment of the service.
DD. Give the task execution role the ssmmessages channel permissions, turn on ECS Exec for the service with a new deployment, and run aws ecs execute-command.
Show the answer and explanation
Answer: A
A. Right: Correct. ECS Exec uses Systems Manager Session Manager, so no SSH server or inbound port is needed. The task role needs the ssmmessages channel permissions, ECS Exec applies only to tasks started after it is turned on, and the cluster setting sends each command and its output to CloudWatch Logs or Amazon S3. Learn more: Monitor Amazon ECS containers with ECS Exec (opens in a new tab)
B. Wrong: This puts an SSH server in the image and opens an inbound port, which the security team does not allow. SSH sessions are also not logged command by command without extra tooling. ECS Exec gives shell access with neither.
C. Wrong: ECS Exec cannot be turned on for existing tasks, only for new ones. Without a new deployment, the running tasks have no command agent, so the session fails.
D. Wrong: The execution role is used by ECS to pull images, write logs and fetch secrets at startup. The SSM agent inside the container uses the task role, so the session cannot open its channels with this setup.
Explanation
ECS Exec opens a shell or runs a command in a running container through Systems Manager Session Manager, with no SSH server or open inbound port. The task role needs the ssmmessages channel permissions, and ECS Exec only works on tasks started after it is turned on, so the service needs a new deployment. The cluster's execute command configuration logs each command and its output to CloudWatch Logs or Amazon S3, and CloudTrail records who ran ExecuteCommand.
Want more on Container images and deployments with ECR, ECS and EKS? The 5 full-length practice sets have 10 more Container images and deployments with ECR, ECS and EKS questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →