A logistics firm runs EC2 workers that must read from S3 and pull from ECR, plus ECS Fargate tasks that must read Secrets Manager and write to DynamoDB. Credentials must never be stored on hosts, and each workload must receive only its own permissions. Which role design should the architect implement to authorize compute workloads?
Select an answer to reveal the explanation.
Short Explanation
You've got two crews needing different tools, so you don't hand them one master key. Give your EC2 workers an instance profile and your Fargate services their own execution and task roles, keeping each job tidy with least privilege.
Full Explanation
The correct design works because instance profiles for EC2 and separate execution and task roles for ECS all deliver short-lived credentials automatically through the instance metadata service and the ECS task agent, so no keys are ever stored on hosts while least privilege is enforced by separation, with the EC2 profile limited to S3 read and ECR pull, the execution role limited to infrastructure needs such as ECR image pull, log delivery and secret injection at launch, and each service task role limited to only its own application needs such as specific Secrets Manager secrets and DynamoDB tables. The shared-role design fails least privilege because giving every Fargate service the same task role grants each task the union of all secrets and table permissions, so a compromised task can access another service data even though credential handling is correct. The execution-only design fails role separation because the execution role belongs to the ECS agent plumbing rather than application code, so placing DynamoDB writes and application reads there over-privileges launches and collapses infrastructure and data-plane boundaries. The design without execution roles fails completeness because Fargate requires an execution role to authenticate to ECR, pull images and deliver logs, so correctly scoped task roles alone leave tasks unable to start. An exam caveat is that prompts pairing ECR pull with DynamoDB or secrets access are testing execution versus task split, with pull and logging in execution and business API calls in task. A practical check is to inspect EC2 user data and ECS task definitions for any static keys, then validate each role with IAM Access Analyzer and Policy Simulator and confirm denied and allowed calls in CloudTrail.