Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

Apex Healthcare is modernizing its prescription processing application by migrating it to AWS. The application will be deployed as containerized tasks using Amazon ECS on AWS Fargate in a VPC in the Production account. The container images must be securely pulled from a centralized Amazon ECR repository in the Shared Services account. To meet regulatory compliance, the ECR images are encrypted at rest using AWS KMS, and all image pull traffic must remain within the AWS network without traversing the public internet.

Which TWO configurations must a solutions architect perform to establish this architecture? (Select TWO.)

  1. In the Shared Services account, encrypt the ECR repository using an AWS KMS customer managed key, and update the key policy to grant the ECS Task Execution IAM Role in the Production account permissions to decrypt using the key.Answer
  2. In the Production account, create Interface VPC endpoints for ECR in the VPC where the tasks are deployed, and configure a Gateway VPC endpoint for Amazon S3 in the same VPC.Answer
  3. C
    In the Shared Services account, encrypt the ECR repository using the default AWS-managed KMS key (aws/ecr), and modify its key policy to grant the ECS Task Execution IAM Role in the Production account permissions to use the key.
  4. D
    In the Production account, configure the ECS task definition to use the host network mode to bypass the need for interface VPC endpoints and route traffic directly to ECR.
  5. E
    In the Shared Services account, create a Route 53 Private Hosted Zone for the ECR DNS name, and associate it with the Production account's VPC to enable private ECR resolution without deploying VPC endpoints.

Answer

In the Shared Services account, encrypt the ECR repository using an AWS KMS customer managed key, and update the key policy to grant the ECS Task Execution IAM Role in the Production account permissions to decrypt using the key. Additionally, in the Production account, create Interface VPC endpoints for ECR in the VPC where the tasks are deployed, and configure a Gateway VPC endpoint for Amazon S3 in the same VPC.
To support private, cross-account ECR image pulls under KMS encryption, you must use a Customer Managed Key in the repository account to delegate decryption permissions to the target account's task execution role. Furthermore, you must establish Interface VPC endpoints in the consumer VPC to allow private communication to ECR API endpoints, alongside a Gateway VPC endpoint for S3 because ECR stores its image layers in S3 buckets.

Step-by-Step Solution

1
Analyze cross-account encryption requirements.
Determine that the default AWS-managed KMS key cannot be shared cross-account, so a Customer Managed Key must be used for ECR repository encryption.
This allows updating the key policy to permit the Production account's ECS Task Execution IAM Role to perform the kms:Decrypt operation.
2
Determine private network connectivity needs inside the Production VPC.
Identify that Interface VPC endpoints for ECR and a Gateway VPC endpoint for S3 are needed.
ECR image manifests are retrieved via the ECR endpoints, while the actual image layers are downloaded from S3, requiring secure private routing for both.
3
Validate network mode compatibility for Fargate tasks.
Verify that tasks launched on AWS Fargate are restricted to the awsvpc network mode.
This eliminates host or bridge network mode configurations as viable alternatives.

Key Concept

Cross-account ECR image pulling with KMS encryption and private endpoint routing on AWS Fargate
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic