Container images and deployments with ECR, ECS and EKS: DVA-C03 study notes and practice questions
What to know about Container images and deployments with ECR, ECS and EKS for the DVA-C03 exam, from the Testing and Deployment domain (22% of the exam guide), then 2 free questions to test it. Part of the DVA-C03 study guide.
These questions follow the container path from an image in ECR to a deployment that failed or needs a safer rollout. Lambda can also run images from ECR (see the packaging note).
ECR images
Tag immutability is set per repository. IMMUTABLE rejects a push when the tag already exists, with an ImageTagAlreadyExistsException. MUTABLE lets a push overwrite a tag. IMMUTABLE_WITH_EXCLUSION keeps tags immutable except those matching filters.
Lifecycle policies expire images by rule, such as keeping the last N images, to control storage cost.
Image scanning finds known vulnerabilities, with scan on push configured at the registry or repository level.
ECS task definitions and roles
A task definition describes the containers, image, CPU, memory, ports and logging.
The task role is the IAM role your application code uses, such as access to a DynamoDB table.
The task execution role is what ECS uses to start the task: pull the image from ECR, write logs, and fetch secrets for injection into the container.
A question about a container that cannot pull its image or cannot read a secret at startup points to the execution role. A question about the app calling an AWS API points to the task role.
Launch types
Fargate runs tasks without servers to manage. Each task gets its own network interface (awsvpc).
EC2 runs tasks on container instances you manage, for custom AMIs or specific hardware.
Deploying and rolling back
The ECS rolling update replaces tasks in place, controlled by minimum and maximum healthy percentages.
The deployment circuit breaker stops a rolling update that will not become healthy. It counts failed tasks that never reach RUNNING, and failed load balancer or container health checks. When the failure count reaches the threshold, the deployment is marked FAILED. With rollback turned on, ECS returns the service to the last COMPLETED deployment.
The circuit breaker works only with rolling updates on the ECS deployment controller.
Blue/green on ECS is either built into ECS (a deployment strategy with a bake time, a test listener and Lambda lifecycle hooks) or run through CodeDeploy, as covered in the deployment strategies note.
EKS
Applications run on EKS from Kubernetes manifests, such as a Deployment and a Service. Image tags in the manifest set the version to run.
A Deployment’s rolling update is controlled by maxSurge and maxUnavailable. Kubernetes replaces pods in steps.
How to choose
Scenario wording
Answer
Stop a release from overwriting an image tag
IMMUTABLE tag setting
Remove old images automatically
Lifecycle policy
Container cannot pull its image at startup
Task execution role
App code needs DynamoDB access
Task role
No servers to manage, and a per-task network
Fargate
Roll back a failed ECS update automatically
Deployment circuit breaker with rollback
Zero-downtime ECS release with a test listener
Blue/green (ECS strategy or CodeDeploy)
Common traps
Using the task role to pull images. That is the execution role’s job.
Using MUTABLE tags for production, then wondering why a deployed tag changed.
Expecting the circuit breaker on blue/green or external controllers. It covers only ECS rolling updates.
Expecting a single failed task to trigger rollback. The circuit breaker acts when the failure count reaches the threshold.
A retail company deploys its order service to Amazon ECS from a shared Amazon ECR repository. Last month, a rebuild pushed a new image under a tag that production was already using. A later rollback to an older task definition revision then ran a different build than the team expected.
Other teams' pipelines rely on moving tags in this repository, so its settings must stay as they are. A rollback must run exactly the image that ran before, and each running image must trace back to its source commit.
Which TWO actions meet these requirements? (Choose two.)
Choose two answers.
AA. Add an ECR lifecycle policy that expires untagged images after seven days, so replaced images are removed before anyone can deploy them.
BB. In each task definition revision, reference the image by its digest (repository@sha256:...) instead of by a tag.
CC. Set the repository's tag mutability to IMMUTABLE, so any push that reuses a tag already in the repository is rejected.
DD. Tag each image with the Git commit SHA it was built from when the build pushes it to the repository.
EE. Have the build script retag the newest image with the release name each time, so the release name always points to the latest build.
Show the answer and explanation
Answers: B, D
A. Wrong: A lifecycle policy removes old images, but it does not stop a tag from pointing to a new build. Expiring old images can also remove the exact image that a rollback needs.
D. Right: Correct. A commit SHA names the one source revision that a build came from, so the image a task runs can be traced to its commit. Each build gets its own SHA, so the pipeline never has a reason to reuse the tag.
E. Wrong: Retagging moves the release name to a new image, which is the exact problem the team is trying to prevent. A task definition that names the release tag can then run a different build after a rollback.
Explanation
Referencing the image by digest in each task definition revision pins it to one exact image, so a rollback runs the same build even if a tag later moves. Tagging each image with its Git commit SHA ties it to one source revision. Tag immutability would also stop tags from moving, but it changes the shared repository that other teams rely on.
A payments team runs an API as an Amazon ECS service on AWS Fargate. A bug appears only in production, and a developer needs a shell inside one running container to inspect files and test network calls.
The security team does not allow SSH servers in images or inbound ports opened for debugging. Every command run in a container must be logged for audit.
Which approach meets these requirements?
Choose one answer.
AA. Turn on ECS Exec with a new deployment, grant the task role the ssmmessages permissions, and set command logging in the cluster's configuration.
BB. Add an OpenSSH server to the image, allow port 22 in the task's security group only from the office IP range, and connect with a key pair.
CC. Turn on ECS Exec for the service, then run aws ecs execute-command against the tasks that are already running, without starting a new deployment of the service.
DD. Give the task execution role the ssmmessages channel permissions, turn on ECS Exec for the service with a new deployment, and run aws ecs execute-command.
Show the answer and explanation
Answer: A
A. Right: Correct. ECS Exec uses Systems Manager Session Manager, so no SSH server or inbound port is needed. The task role needs the ssmmessages channel permissions, ECS Exec applies only to tasks started after it is turned on, and the cluster setting sends each command and its output to CloudWatch Logs or Amazon S3. Learn more: Monitor Amazon ECS containers with ECS Exec (opens in a new tab)
B. Wrong: This puts an SSH server in the image and opens an inbound port, which the security team does not allow. SSH sessions are also not logged command by command without extra tooling. ECS Exec gives shell access with neither.
C. Wrong: ECS Exec cannot be turned on for existing tasks, only for new ones. Without a new deployment, the running tasks have no command agent, so the session fails.
D. Wrong: The execution role is used by ECS to pull images, write logs and fetch secrets at startup. The SSM agent inside the container uses the task role, so the session cannot open its channels with this setup.
Explanation
ECS Exec opens a shell or runs a command in a running container through Systems Manager Session Manager, with no SSH server or open inbound port. The task role needs the ssmmessages channel permissions, and ECS Exec only works on tasks started after it is turned on, so the service needs a new deployment. The cluster's execute command configuration logs each command and its output to CloudWatch Logs or Amazon S3, and CloudTrail records who ran ExecuteCommand.
Want more on Container images and deployments with ECR, ECS and EKS? The 5 full-length practice sets have 10 more Container images and deployments with ECR, ECS and EKS questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Container images and deployments with ECR, ECS and EKS