Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

Kestrel Analytics is modernizing its legacy telemetry processing application by migrating it from an on-premises data center to AWS. The application processes high-throughput sensor data and writes the results to a self-managed database cluster running in a private subnet within a Virtual Private Cloud (VPC). The analytics team wants to containerize the application and run it on Amazon ECS using the AWS Fargate launch type to reduce operational overhead. The tasks must securely connect to the database cluster and must not have direct public internet connectivity, while the database security group must restrict inbound traffic to only the tasks. Which network configuration should a solutions architect recommend to meet these requirements?

  1. Configure the ECS task definition to use the awsvpc network mode. Deploy the Fargate tasks in private subnets, and configure the database security group to allow inbound traffic from the security group assigned to the ECS tasks.Answer
  2. B
    Configure the ECS task definition to use the bridge network mode to allow container port mapping. Deploy the Fargate tasks in private subnets, and configure the database security group to allow inbound traffic from the security group of the underlying container instances.
  3. C
    Configure the ECS task definition to use the host network mode. Deploy the Fargate tasks in private subnets, and resolve the database hostname using a Route 53 Private Hosted Zone that is created but not associated with the VPC.
  4. D
    Configure the ECS task definition to use the awsvpc network mode. Deploy the Fargate tasks in a single Availability Zone, and configure the route tables to direct all database-bound traffic through a single NAT Gateway deployed in a single public subnet.

Answer

Configure the ECS task definition to use the awsvpc network mode. Deploy the Fargate tasks in private subnets, and configure the database security group to allow inbound traffic from the security group assigned to the ECS tasks.
Configuring the ECS task definition to use the awsvpc network mode allows each task to receive its own ENI and security group. The database security group can then be configured to allow inbound access specifically from the task security group, ensuring secure, least-privilege access.

Step-by-Step Solution

1
Select the correct network mode for AWS Fargate tasks.
AWS Fargate only supports the awsvpc network mode, which assigns a dedicated Elastic Network Interface (ENI) to each task.
This network mode allows standard VPC security groups to be attached directly to ECS Fargate tasks.
2
Deploy the tasks in private subnets and configure security groups.
The tasks are placed in private subnets with no direct public internet access, and are assigned a specific task security group.
This setup isolates the compute resources from external exposure.
3
Configure the database security group inbound rules.
An inbound rule is added to the database's security group that references the security group of the ECS Fargate tasks as the source.
This ensures that only traffic originating from Fargate tasks with that security group can connect to the database, implementing the principle of least privilege.

Key Concept

AWS Fargate tasks only support the awsvpc network mode, which allows them to obtain dedicated ENIs and use security groups to secure task-to-database communication.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic