A county runs a public citizen API and a payroll microservice as separate ECS services. Security wants a breach of the public API task unable to write to payroll DynamoDB tables. How should task IAM be designed?
Select an answer to reveal the explanation.
Short Explanation
One giant role is a master key for the whole courthouse—lose the public door and payroll opens too. Give each ECS service its own task role with only the tables it needs. Blast radius stays local.
Full Explanation
ECS task roles should follow least privilege per microservice. A dedicated role for the public API that omits payroll write permissions prevents lateral movement if that task is compromised. A shared AdministratorAccess role, plaintext payroll credentials on the public task, or baked-in access keys enlarge blast radius and violate secure microservice IAM patterns.