Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

A digital publishing company, AuraMedia, is modernizing its legacy editorial content management system (CMS) by migrating it from an on-premises virtualized environment to AWS. The new architecture will run as containerized microservices on Amazon ECS. The application consists of a public-facing reader service in a Front-End VPC and a sensitive, restricted content ingestion service in a Back-End VPC under a separate AWS account. The content ingestion service must process raw files, store metadata in Amazon DynamoDB, and encrypt assets using AWS KMS. All data transfer between the VPCs and to AWS services must remain entirely within the AWS private network to meet strict data privacy compliance standards. The reader service needs to resolve the private DNS names of the ingestion service tasks. To minimize server maintenance, the solutions architect must use AWS Fargate. The system must achieve a Recovery Time Objective (RTO) of 15 minutes. Which design satisfies these security and connectivity requirements with the least operational overhead?

  1. Configure the Amazon ECS tasks for both services to use the awsvpc network mode. Deploy the ingestion service in the Back-End VPC with interface VPC endpoints for AWS KMS, Amazon ECR, and Amazon ECS, and a gateway VPC endpoint for Amazon DynamoDB. Configure AWS Cloud Map for service discovery, which creates a Route 53 private hosted zone. Associate this private hosted zone with the Front-End VPC across accounts. Establish VPC peering between the Front-End and Back-End VPCs, and update route tables to allow direct container-to-container traffic.Answer
  2. B
    Configure the Amazon ECS tasks for the ingestion service using the bridge network mode to optimize container-to-container communication within Fargate. Deploy the tasks in private subnets, configure AWS Cloud Map for service discovery, and set up an AWS Transit Gateway to route traffic between the Front-End VPC and the Back-End VPC. Create interface VPC endpoints for AWS KMS and Amazon DynamoDB.
  3. C
    Configure the Amazon ECS tasks to use the awsvpc network mode. Deploy the ingestion service in the Back-End VPC with a gateway VPC endpoint for Amazon DynamoDB and interface VPC endpoints for AWS KMS. Configure AWS Cloud Map to register tasks under a private hosted zone in the Back-End VPC's account. Set up VPC peering between the VPCs, but do not associate the hosted zone with the Front-End VPC, relying on the VPC peering connection to automatically propagate DNS queries between the accounts.
  4. D
    Configure the Amazon ECS tasks to use the awsvpc network mode. Deploy the ingestion service in the Back-End VPC and configure the tasks to use the default AWS-managed KMS key (aws/kms) for cross-account encryption. Instead of VPC endpoints, deploy a single NAT Gateway in a public subnet of the Back-End VPC to route outbound traffic to AWS KMS and Amazon DynamoDB, and use AWS Cloud Map for service discovery without cross-account private hosted zone associations.

Answer

Configure the Amazon ECS tasks for both services to use the awsvpc network mode, configure the private endpoints for DynamoDB, KMS, ECR, and ECS, and associate the AWS Cloud Map Route 53 private hosted zone with the Front-End VPC across accounts while establishing VPC peering.
The correct architecture uses the awsvpc network mode for ECS tasks, which is mandatory for Fargate. It establishes private connection endpoints (Gateway VPC endpoint for DynamoDB, Interface VPC endpoints for KMS, ECR, and ECS) to prevent any traffic from traversing the public internet, satisfying the compliance requirement. For service discovery, it leverages AWS Cloud Map, and manually associates the resulting Route 53 Private Hosted Zone with the reader service's Front-End VPC across accounts. Finally, VPC peering provides the private network path for inter-service communication.

Step-by-Step Solution

1
Select the correct network mode for Fargate tasks.
Confirm the use of awsvpc network mode for the ECS task definitions.
AWS Fargate only supports the awsvpc network mode, which assigns a unique elastic network interface (ENI) to each task.
2
Design private endpoint access to AWS services.
Provision a gateway endpoint for Amazon DynamoDB, and interface VPC endpoints for AWS KMS, Amazon ECR (api and dkr), and Amazon ECS (agent, telemetry, and ecs).
Ensures that calls from Fargate tasks to pull container images, access state, write to DynamoDB, and encrypt assets remain strictly within the AWS private network without internet traversal.
3
Configure DNS resolution and network peering.
Establish VPC peering between the Front-End and Back-End VPCs, update route tables, and associate the AWS Cloud Map Route 53 Private Hosted Zone with the Front-End VPC.
Allows the reader service in the Front-End VPC to resolve the private DNS names of the ingestion service tasks and route traffic directly to their ENIs.

Key Concept

Cross-account Amazon ECS Fargate networking and Route 53 Private Hosted Zone associations using AWS Cloud Map
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic