Examkin

Question

Difficulty: Very hardAuto Scaling and Elastic Load Balancing (ELB)

A startup is deploying a microservices application using Amazon ECS with the Amazon EC2 launch type. The tasks run on EC2 instances managed by an Auto Scaling group (ASG) in private subnets. The application uses dynamic port mapping, where the container's port 8080 is mapped to a dynamically allocated host port in the range 32768−6100032768-61000 on the EC2 instances. An Application Load Balancer (ALB) in the public subnets routes external traffic from port 443443 to the target group associated with the ECS service.

The security team has configured custom Network ACLs (NACLs) and Security Groups to enforce strict traffic filtering:
1. Public Subnet NACL:
- Inbound: Allows TCP port 443443 from 0.0.0.0/0.
- Outbound: Allows all traffic.
2. Private Subnet NACL:
- Inbound: Allows TCP port 443443 and ephemeral ports 1024−655351024-65535 from the public subnets.
- Outbound: Allows all traffic.
3. EC2 Instance Security Group:
- Inbound: Allows TCP port 8080 from the ALB security group.
- Outbound: Allows all traffic.

The target group has its health check port configured to traffic-port. The ECS tasks fail to register successfully because the ALB marks the targets as unhealthy, causing the ASG to terminate and relaunch the EC2 instances.

Which action should the solutions architect take to resolve this issue and allow the health checks to pass?

  1. A
    Modify the target group health check configuration to use HTTP port 8080 instead of the default traffic-port.
  2. B
    Configure the private subnet Network ACL to allow stateful return traffic on ports 32768−6100032768-61000 from the ALB.
  3. Update the security group of the EC2 instances to allow inbound TCP traffic on the dynamic port range 32768−6100032768-61000 from the ALB security group.Answer
  4. D
    Create an Amazon Route 53 Latency routing policy to route traffic directly to the private IP addresses of the EC2 instances.

Answer

Update the security group of the EC2 instances to allow inbound TCP traffic on the dynamic port range 32768−6100032768-61000 from the ALB security group.
The correct answer is to update the security group of the EC2 instances to allow inbound TCP traffic on the dynamic port range 32768−6100032768-61000 from the ALB security group. Because the ECS tasks use dynamic port mapping, the container port is mapped to a dynamic host port. The ALB health check is configured to use traffic-port, meaning it will query the dynamic host port. The security group of the EC2 instances must allow inbound traffic on this dynamic range from the load balancer's security group to allow the health checks to succeed.

Step-by-Step Solution

1
Analyze the application architecture and port configurations.
The ECS tasks use dynamic port mapping, mapping container port 8080 to host ports in the range 32768−6100032768-61000. The ALB target group health check is set to traffic-port.
Understanding which ports are actively listening on the host EC2 instances is critical to determining where health check traffic is being sent.
2
Identify the destination port of the ALB health checks.
The ALB health checks are sent to the dynamically allocated host ports in the range 32768−6100032768-61000.
Since traffic-port is configured, the load balancer dynamically targets the host port registered for each container task.
3
Evaluate the network access control and security group rules for the destination ports.
The private subnet NACL allows inbound traffic on ephemeral ports 1024−655351024-65535 (which covers 32768−6100032768-61000). However, the EC2 instance security group only allows inbound traffic on port 8080.
Both NACLs and security groups must allow the traffic. The security group is currently blocking the health check traffic on the dynamic host ports.
4
Formulate the correct modification to allow the health checks to pass.
Updating the EC2 instance security group to allow inbound TCP traffic on the dynamic range 32768−6100032768-61000 from the ALB's security group allows the health checks to reach the containerized tasks.
This configuration allows the ALB to reach the dynamically mapped host ports while maintaining security group-level access control.

Key Concept

Auto Scaling and Elastic Load Balancing (ELB) integration with ECS dynamic port mapping
Estimated Time:3m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic