Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

NovaCare Telehealth is modernizing its HIPAA-compliant patient-record processing service by migrating its on-premises microservices to AWS. The target architecture must run on Amazon ECS using the AWS Fargate launch type to minimize operational overhead. The containers must run in a private VPC with no internet access. The application needs to securely retrieve database credentials and API keys stored in AWS Systems Manager Parameter Store. These parameters are encrypted using a customer managed key (CMK) in AWS Key Management Service (AWS KMS) located in a centralized security account. All AWS service traffic must traverse private VPC endpoints. Which solution configuration meets these security and compliance requirements with the least operational overhead?

  1. A
    Deploy the Amazon ECS tasks using the AWS Fargate launch type with the bridge network mode. Create interface VPC endpoints for Systems Manager Parameter Store and AWS KMS in the application VPC. Grant the ECS task execution role permissions to decrypt the customer managed key in the security account and read the parameters.
  2. B
    Deploy the Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Create interface VPC endpoints for Systems Manager Parameter Store and AWS KMS in the application VPC. Configure the Parameter Store parameters to use the AWS-managed KMS key in the centralized security account, and grant the ECS task execution role permissions to decrypt the parameters.
  3. Deploy the Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Create interface VPC endpoints for Systems Manager Parameter Store and AWS KMS in the application VPC. Grant the ECS task execution role permissions to decrypt the customer managed key in the security account and read the parameters.Answer
  4. D
    Deploy the Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode. Create interface VPC endpoints for Systems Manager Parameter Store and AWS KMS in a shared services VPC. Configure a Route 53 private hosted zone in the shared services VPC to resolve endpoint DNS names, without associating the private hosted zone with the application VPC.

Answer

Deploy the Amazon ECS tasks using the AWS Fargate launch type with the awsvpc network mode, create interface VPC endpoints locally in the application VPC, and grant the ECS task execution role permissions to decrypt the customer managed key in the security account and read the parameters.
The correct solution correctly specifies the awsvpc network mode, which is mandatory for AWS Fargate. It sets up interface VPC endpoints locally in the isolated application VPC to facilitate private connectivity to Systems Manager and KMS. Since the KMS key resides in a separate centralized security account, a customer managed key is used, as it is the only key type that allows cross-account permissions. Finally, permissions are granted to the ECS task execution role, which is the role responsible for fetching secrets and parameter values during container startup.

Step-by-Step Solution

1
Select the correct network mode for AWS Fargate.
The tasks must be configured to use the awsvpc network mode.
AWS Fargate does not support bridge or host network modes; it exclusively requires the awsvpc network mode.
2
Establish secure private connectivity to AWS services.
Create interface VPC endpoints (AWS PrivateLink) for Systems Manager Parameter Store and AWS KMS in the application VPC.
Because the VPC lacks internet access, interface VPC endpoints are required to privately route requests to Parameter Store and KMS.
3
Configure cross-account KMS decryption permissions.
Use a customer managed key (CMK) in the security account and modify its key policy to allow the application's ECS task execution role to perform kms:Decrypt operations.
AWS-managed keys (like aws/ssm) cannot be modified to delegate access to external AWS accounts. A customer managed key is necessary for cross-account decryption.

Key Concept

Deploying containerized workloads on AWS Fargate requires the awsvpc network mode. Accessing services from a fully isolated VPC requires interface VPC endpoints, and cross-account KMS access requires customer managed keys.
Estimated Time:2m 30s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic