Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

CareFlow Systems is modernizing its legacy patient registration API by migrating it from on-premises servers to AWS. The solution will run on Amazon ECS using AWS Fargate across three Availability Zones (AZs) in a single VPC. The application requires outbound internet access to contact third-party medical validation services and must also securely access a legacy database located in the on-premises datacenter via an AWS Direct Connect connection. The database endpoint must be resolved using a private DNS domain hosted in a shared services VPC in a different AWS account within the organization. Which network and container configuration should a solutions architect recommend to satisfy these requirements with high availability?

  1. A
    Configure the Amazon ECS tasks to use the bridge network mode. Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Associate the Route 53 Private Hosted Zone from the shared services account with the application VPC.
  2. B
    Configure the Amazon ECS tasks to use the awsvpc network mode. Deploy a single NAT Gateway in a public subnet in one of the Availability Zones. Associate the Route 53 Private Hosted Zone from the shared services account with the application VPC.
  3. Configure the Amazon ECS tasks to use the awsvpc network mode. Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Associate the Route 53 Private Hosted Zone from the shared services account with the application VPC.Answer
  4. D
    Configure the Amazon ECS tasks to use the awsvpc network mode. Deploy a NAT Gateway in a public subnet in each of the three Availability Zones. Rely on the Route 53 Private Hosted Zone in the shared services VPC to automatically resolve the database domain across the organization without manual association.

Answer

Configure the Amazon ECS tasks to use the awsvpc network mode, deploy a NAT Gateway in each Availability Zone, and associate the Route 53 Private Hosted Zone from the shared services account with the application VPC.
The correct architecture uses the awsvpc network mode, which is the only network mode supported by AWS Fargate. High availability is maintained for outbound internet traffic by deploying redundant NAT Gateways across all three Availability Zones, ensuring that a single zone failure does not impact the entire system. Private DNS resolution for the database domain is achieved by explicitly associating the Route 53 Private Hosted Zone from the shared services account with the VPC where the ECS tasks are running.

Step-by-Step Solution

1
Select the correct network mode for the Amazon ECS task definition on AWS Fargate.
Use the awsvpc network mode.
AWS Fargate only supports the awsvpc network mode, which allocates an Elastic Network Interface (ENI) to each task.
2
Design redundant outbound path configurations for high availability.
Deploy one NAT Gateway in each of the three Availability Zones.
Deploying a NAT Gateway in each zone ensures that an outage in one zone does not disrupt internet connectivity for tasks running in the remaining zones.
3
Enable DNS resolution for the cross-account database domain name.
Associate the Route 53 Private Hosted Zone hosted in the shared services account with the application VPC.
A Private Hosted Zone must be explicitly associated with any VPC that needs to resolve its DNS records, even if the VPCs belong to the same AWS Organization.

Key Concept

Architecting highly available container networking and private DNS resolution for AWS Fargate tasks.
Estimated Time:2m 0s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic