Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

NexaChem Laboratories is modernizing its laboratory information management system (LIMS) by migrating its containerized chemical analysis microservices to Amazon ECS on AWS Fargate. To comply with strict industry data privacy standards, the microservices must run in a fully private VPC containing only private subnets, with no direct access to the public internet. The container images are built and stored in a centralized Amazon Elastic Container Registry (ECR) repository located in a Shared Services AWS account, and are encrypted using an AWS Key Management Service (AWS KMS) customer managed key (CMK). The ECS tasks also need to access sensitive database credentials stored in AWS Systems Manager Parameter Store in the application account, which are encrypted using a local CMK. Which combination of configuration steps is required to allow the ECS tasks to successfully pull the container images and launch on AWS Fargate? (Select TWO.)

  1. Create interface VPC endpoints (AWS PrivateLink) in the application VPC for the Amazon ECR API, the ECR Docker registry, and AWS KMS. Create a gateway VPC endpoint for Amazon S3 in the application VPC, and associate it with the route tables of the private subnets where the ECS tasks are deployed.Answer
  2. Configure the ECR repository policy in the Shared Services account to grant read permissions to the application account's ECS Task Execution Role. Update the ECS Task Execution Role's IAM policy in the application account to allow access to ECR API actions and kms:Decrypt permissions on the KMS customer managed key located in the Shared Services account.Answer
  3. C
    Configure the ECS task definition network mode to use host or bridge networking instead of awsvpc, allowing the tasks to leverage local Docker daemon routing to pull images from the cross-account ECR repository.
  4. D
    Encrypt the ECR repository using the default AWS-managed KMS key for ECR (aws/ecr) in the Shared Services account, and modify the key policy of this AWS-managed key to grant kms:Decrypt permissions to the application account's ECS Task Execution Role.
  5. E
    Create a Route 53 Private Hosted Zone for the ECR endpoints in the Shared Services account, and create alias records pointing to the Shared Services VPC endpoints without associating the hosted zone with the application VPC.

Answer

Establishing interface endpoints for ECR and KMS along with a gateway endpoint for S3 in the private VPC, combined with granting ECR and KMS decrypt access to the task execution role across accounts.
For ECS on AWS Fargate tasks running in a completely private subnet to pull images from a cross-account ECR repository, two conditions must be met: network accessibility and IAM/KMS permissions. Network accessibility requires interface endpoints for ECR APIs and KMS, as well as an S3 gateway endpoint (since ECR stores image layers in S3). Security requires that the ECS Task Execution Role (which performs the pull and decrypt operations) is granted permission in the ECR repository policy and has kms:Decrypt permissions on the customer managed key in the Shared Services account.

Step-by-Step Solution

1
Determine the necessary networking endpoints for ECS Fargate to pull from ECR without internet access.
Identify that VPC Interface Endpoints are required for ECR API, ECR registry, and KMS. Additionally, a Gateway Endpoint for S3 is required because ECR stores image layers in S3 buckets.
Since the VPC lacks an internet gateway or NAT gateway, all communication to AWS APIs and S3 layer storage must go through private endpoints.
2
Establish the cross-account ECR repository and KMS key permissions.
Grant cross-account read access to the application account's ECS Task Execution Role on the Shared Services ECR repository policy, and grant kms:Decrypt permissions on the customer managed key (CMK) policy in the Shared Services account.
The Task Execution Role runs outside the user container context to pull and decrypt images, requiring explicit access to the cross-account repository and CMK.

Key Concept

Configuring secure, private, cross-account image pulls for Amazon ECS tasks running on AWS Fargate in a restricted network environment.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic