Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

AeroRoute Logistics is migrating an on-premises containerized fleet routing application to AWS. The application consists of a front-end API service and a backend routing engine. The Solutions Architect has designed a multi-account AWS architecture where the container images will be stored in a centralized Amazon Elastic Container Registry (Amazon ECR) repository in a Shared Services account. The application must run on Amazon ECS using AWS Fargate within an Application VPC. The Application VPC is distributed across three Availability Zones with public and private subnets. For service discovery, a Route 53 Private Hosted Zone (PHZ) is hosted in the Shared Services account. The deployment must be highly available, minimize operational overhead, and allow tasks to securely resolve internal endpoints and pull images. Which TWO actions should the Solutions Architect perform to meet these requirements?

  1. Configure the ECS task definitions to use the `awsvpc` network mode, and grant the ECS task execution role permissions to pull container images from the Amazon ECR repository in the Shared Services account.Answer
  2. Associate the Route 53 Private Hosted Zone in the Shared Services account with the Application VPC.Answer
  3. C
    Configure the ECS task definitions to use the `bridge` network mode to enable dynamic port mapping and optimize task-to-task communication on AWS Fargate.
  4. D
    Create an identical Route 53 Private Hosted Zone in the Application account, as Private Hosted Zones automatically sync records across accounts within the same AWS Organization.
  5. E
    Deploy a single NAT Gateway in one public subnet, and route outbound traffic from all private subnets across all three Availability Zones through this NAT Gateway to minimize hourly resource charges.

Answer

Configure the ECS task definitions to use the `awsvpc` network mode, grant the ECS task execution role permissions to pull container images from the Amazon ECR repository in the Shared Services account, and associate the Route 53 Private Hosted Zone in the Shared Services account with the Application VPC.
To deploy containers on AWS Fargate, the `awsvpc` network mode is mandatory. The task execution role requires permissions to perform the cross-account image pull from the ECR registry in the Shared Services account. For DNS resolution of internal service endpoints across accounts, the Route 53 Private Hosted Zone in the Shared Services account must be explicitly associated with the Application VPC.

Step-by-Step Solution

1
Identify the mandatory container runtime environment and networking requirements for AWS Fargate.
AWS Fargate requires the `awsvpc` network mode, and the ECS task execution role must have permission to pull the container image from the centralized ECR repository in the Shared Services account.
Fargate does not support bridge or host networking modes; each task must receive its own Elastic Network Interface (ENI).
2
Determine the service discovery and DNS resolution strategy across accounts.
The Route 53 Private Hosted Zone (PHZ) in the Shared Services account must be associated with the Application VPC in the Application account.
PHZ records are not shared or synced automatically; an explicit cross-account association is required for DNS resolution to function.
3
Verify high availability requirements for outbound network paths.
NAT Gateways must be deployed in each Availability Zone rather than a single NAT Gateway.
A single NAT Gateway creates a single point of failure, violating the high availability requirement across multiple Availability Zones.

Key Concept

Cross-account Amazon ECS Fargate deployment, private DNS resolution, and high-availability egress routing.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic