Examkin

Question

Difficulty: MediumCost-Effective Network Routing and Data Transfer Optimization

A company hosts a microservices application on Amazon ECS using AWS Fargate. The ECS tasks run in private subnets and frequently pull large container images from Amazon Elastic Container Registry (ECR). The company notices a significant increase in their monthly bill due to NAT Gateway data processing charges. Which solution is the most cost-effective way to reduce these charges while maintaining security?

  1. Configure Interface VPC Endpoints for ECR, and configure a Gateway VPC Endpoint for Amazon S3. Update the route table of the private subnets to route S3 traffic through the Gateway Endpoint.Answer
  2. B
    Configure Interface VPC Endpoints for ECR only, and allow the ECS tasks to retrieve the container image layers through the NAT Gateway.
  3. C
    Configure Interface VPC Endpoints for both ECR and Amazon S3, and update the ECS task definitions to use the new endpoints.
  4. D
    Assign public IP addresses to the ECS tasks and route the image download traffic through an Internet Gateway instead of the NAT Gateway.

Answer

Configure Interface VPC Endpoints for ECR, and configure a Gateway VPC Endpoint for Amazon S3. Update the route table of the private subnets to route S3 traffic through the Gateway Endpoint.
The correct option is to configure Interface VPC Endpoints for ECR and a Gateway VPC Endpoint for Amazon S3. When an ECS Fargate task pulls a container image from Amazon ECR, it authenticates and downloads the image manifest via ECR APIs, and then pulls the actual container layers from Amazon S3. By using ECR Interface Endpoints, the API traffic remains private. By using an S3 Gateway Endpoint, the large image layers are pulled directly from S3 without passing through the NAT Gateway, avoiding the NAT Gateway data processing charge.

Step-by-Step Solution

1
Analyze the data flow when pulling container images from ECR.
ECR stores the manifest and API metadata on the ECR service, but the actual image layers are stored in Amazon S3.
This helps locate the source of the heavy data transfer that is driving up NAT Gateway processing charges.
2
Choose the correct endpoint type for ECR API calls.
Establish ECR Interface VPC Endpoints (PrivateLink) for the dkr and api service endpoints.
ECR requires Interface VPC Endpoints for private connectivity within a VPC.
3
Choose the most cost-effective endpoint type for the S3 image layers.
Create a Gateway VPC Endpoint for Amazon S3 and associate it with the private subnet's route table.
S3 Gateway Endpoints are free and do not charge for data processing, unlike NAT Gateways or Interface Endpoints.

Key Concept

S3 Gateway Endpoints bypass NAT Gateway charges for ECR image downloads because container layers are stored in S3.
Rate this question

Topics

Cost-Effective Network Routing and Data Transfer Optimization