Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

AeroVigil Systems is modernizing an on-premises network security monitoring tool by migrating the workload to Amazon ECS. The application is a packet-inspection agent that requires direct access to the host's physical network interfaces to sniff and analyze network traffic in promiscuous mode. To meet high availability requirements, the containerized workload must be distributed across multiple Availability Zones. Additionally, the solutions architect must ensure compliance with the following enterprise constraints:

1. All container images must be securely stored and pulled from an Amazon Elastic Container Registry (ECR) repository located in a central Shared Services AWS account.
2. The ECS tasks must resolve internal server endpoints using a Route 53 Private Hosted Zone (PHZ) for internal.aerovigil.com that is managed in the Shared Services AWS account.
3. The design must minimize operational overhead where possible, without compromising the core packet-sniffing functionality.

Which architecture should the solutions architect recommend to satisfy these requirements?

  1. A
    Deploy the tasks on Amazon ECS using the AWS Fargate launch type to minimize operational overhead. Configure the task definition to use the host network mode. In the Shared Services AWS account, authorize a Route 53 Private Hosted Zone association with the VPC in the ECS account. In the ECS account, associate the Private Hosted Zone with the ECS VPC.
  2. B
    Deploy the tasks on Amazon ECS using the EC2 launch type. Configure the task definition to use the bridge network mode. Create a duplicate Route 53 Private Hosted Zone for internal.aerovigil.com in the ECS account, associate it with the ECS VPC, and deploy a cron-based sync mechanism to copy DNS records from the Shared Services account.
  3. Deploy the tasks on Amazon ECS using the EC2 launch type. Configure the task definition to use the host network mode. In the Shared Services AWS account, authorize a Route 53 Private Hosted Zone association with the VPC in the ECS account. In the ECS account, associate the Private Hosted Zone with the ECS VPC.Answer
  4. D
    Deploy the tasks on Amazon ECS using the EC2 launch type. Configure the task definition to use the host network mode. Set up an AWS Transit Gateway to establish connectivity between the ECS VPC and the Shared Services VPC, relying on default Transit Gateway route propagation to resolve private DNS queries.

Answer

Deploy the tasks on Amazon ECS using the EC2 launch type with the host network mode, and configure a cross-account Route 53 Private Hosted Zone association between the Shared Services account and the ECS VPC.
The correct solution involves deploying the packet-inspection agent on Amazon ECS with the EC2 launch type, configuring the task definition to use host network mode, and setting up a cross-account Route 53 Private Hosted Zone association. Since the containerized agent needs direct access to the physical host interfaces to sniff traffic, host networking is required. AWS Fargate is incompatible because it only supports awsvpc networking. Resolving the private domain from the Shared Services account requires establishing a cross-account PHZ association, which is authorized by the owner account and accepted by the consumer VPC.

Step-by-Step Solution

1
Determine the required Amazon ECS launch type and networking mode.
The packet-inspection agent requires raw access to the host's physical network interface, which necessitates using the host network mode on the Amazon ECS EC2 launch type. AWS Fargate is ruled out because it only supports the awsvpc network mode, which abstracts host network access.
Host networking binds the container ports and network interfaces directly to the container instance's interfaces, enabling packet sniffing.
2
Configure cross-account private DNS resolution.
Authorize the association of the Shared Services Route 53 Private Hosted Zone (PHZ) with the ECS VPC from the Shared Services account. Then, submit the association request from the ECS VPC account.
This allows tasks in the ECS VPC to query and resolve internal hostnames managed by the centralized PHZ without duplicate zones or additional DNS server deployments.
3
Configure ECR cross-account registry permissions.
Add a registry policy to the ECR repository in the Shared Services account to permit the ECS task execution role and ECS container instances in the member account to pull container images.
This ensures the container runtime on the EC2 instances can securely download the monitoring agent images.

Key Concept

Host network mode implementation on ECS EC2 for network-dependent workloads, combined with Route 53 cross-account Private Hosted Zone association.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic