avatar

Serverless Containers with ECS Fargate - Part 2

Mobycast
Mobycast
Episode • Nov 13, 2019 • 57m

Support Mobycast
https://glow.fm/mobycast

In this episode, we cover the following topics:

  • Identity and access management for ECS
    • Primary roles
      • ECS Container Instance IAM Role
        • ecsInstanceRole
        • IAM policy and role required by ECS agent to make ECS API calls on your behalf
      • ECS Service Scheduler IAM Role
        • ecsServiceRole
        • ECS service scheduler makes calls to EC2 and ELB APIs on your behalf
          • Register/deregister container instances with load balancers
      • ECS Task Execution IAM Role
        • ecsTaskExecutionRole
        • Also used by ECS agent to make AWS API calls on your behalf
        • Typical use cases
          • Your task uses Fargate and is...
            • pulling a container image from Amazon ECR
            • uses the awslogs log driver
          • Your tasks uses either Fargate or EC2 launch type and...
            • pulls images from private registry
            • the task definition is referencing sensitive data using Secrets Manager or Parameter Store
    • Secondary roles
      • ECS Service Auto Scaling IAM Role
        • ecsAutoscaleRole
        • Used by Application Auto Scaling service to describe CloudWatch alarms and registered services
          • Updates ECS services's desired count
      • CloudWatch Events IAM Role
        • ecsEventsRole
        • Required role when you have ECS scheduled tasks
        • Interacts with CloudWatch Events rules and targets
        • This IAM policy and role gives CloudWatch permissions to run ECS tasks on your behalf
      • ECS CodeDeploy IAM Role
        • ecsCodeDeployRole
        • Required when doing blue/green deployments (powered by CodeDeploy)
    • Best practice: Using task-based IAM roles
      • IAM role for Amazon ECS tasks
        • Allows you to specify an IAM role that can be used by the containers in a task
        • IAM role for task is specified using the taskRoleArn setting in task definition
      • Prefer more granular task-based IAM roles over instance roles
      • Each specific task definition or service should have its own role
      • Benefits of task-based IAM roles
        • Least privilege
          • By specifying access at the task-level (instead of at the instance-level), we can have fine-grained control
          • Only give the minimum required permissions for the tasks to operate
        • Credential isolation
          • Container can only use credentials assigned to it
        • Auditability
          • Access and event logging available via CloudTrail
          • CloudTrail logs show taskArn
      • Creating a task-based IAM role
        • First create IAM policy that specifies the minimal permissions needed by your containers
          • Or use an existing managed policy
        • Next create an IAM role for your task
          • Create role based on Amazon Elastic Container Service Task Role service role
        • Then attach your IAM policy to the task role
        • Example: Container needs to make S3 calls
          • Create a new IAM role for the task, and attach the "AmazonS3ReadOnlyAccess" policy to the role
          • Then use the role ARN in task definition

Links


End Song
Beauty in Rhythm (Fredy Grogan Remix) - Roy England

For a full transcription of this episode, please visit the episode webpage.

We'd love to hear from you! You can reach us at: