Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

An enterprise logistics company, 'LogiGlobal', is modernizing its core package tracking system by migrating its on-premises microservices to AWS. The microservices must run on Amazon ECS with AWS Fargate to minimize compute management overhead. The tasks need to pull container images from a centralized Amazon Elastic Container Registry (ECR) repository located in a shared services AWS account. All network traffic between the Fargate tasks and the ECR repository must remain entirely within the AWS private network to satisfy security compliance. Additionally, the Fargate tasks must resolve the ECR endpoint using the default private DNS names. Which of the following configuration strategies should a Solutions Architect implement to meet these requirements with the least operational overhead?

  1. Deploy the tasks using the awsvpc network mode. Create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3 in the application VPC, enabling private DNS. Grant pull permissions to the application account's task execution IAM role in the shared services ECR repository policy.Answer
  2. B
    Deploy the tasks using the bridge network mode to enable container port mapping. Create interface VPC endpoints for ECR and Amazon S3 in the application VPC, and configure the task execution role in the application account with ECR permissions.
  3. C
    Deploy the tasks using the awsvpc network mode. Create the interface VPC endpoints for ECR in the shared services VPC with Private DNS enabled. Create an AWS Transit Gateway to route traffic between the application VPC and the shared services VPC without associating the shared services private hosted zone with the application VPC.
  4. D
    Deploy the tasks using the awsvpc network mode. Create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3 in the application VPC. Encrypt the ECR repository using the AWS-managed KMS key (aws/ecr), and add the application task execution IAM role as a key user in the key policy.

Answer

Deploy the tasks using the awsvpc network mode. Create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3 in the application VPC, enabling private DNS. Grant pull permissions to the application account's task execution IAM role in the shared services ECR repository policy.
To run ECS tasks on AWS Fargate, the network mode must be set to 'awsvpc', as Fargate does not support other modes like bridge or host. Because the tasks are in a private subnet and must not access the public internet, VPC endpoints are required. ECR requires interface VPC endpoints (AWS PrivateLink) for both the API and dkr services. Furthermore, because ECR stores image layers in Amazon S3, the tasks also need access to S3. Creating an S3 gateway VPC endpoint in the application VPC is the most cost-effective way to allow tasks to download image layers privately. Finally, to pull images across accounts, the ECR repository policy in the shared services account must explicitly grant permissions to the application account's ECS task execution IAM role.

Step-by-Step Solution

1
Configure the ECS task definition to use AWS Fargate with the awsvpc network mode.
The task is configured for launch-type compatibility with Fargate and secures its own dedicated Elastic Network Interface (ENI).
Fargate only supports the awsvpc network mode for task container networking.
2
Create interface VPC endpoints for ecr.api and ecr.dkr, and a gateway VPC endpoint for Amazon S3 in the application VPC.
Private network paths are established for API calls and image layer downloads.
Fargate tasks in a private subnet need private endpoints to reach ECR and retrieve image layers from S3 without internet access.
3
Configure the ECR repository policy in the shared services account to grant the ecr:BatchGetImage and ecr:GetDownloadUrlForLayer permissions to the application account's ECS task execution role.
The ECS agent running the Fargate task is authorized to authenticate and pull the container image cross-account.
Cross-account repository access requires permissions to be granted on the resource policy of the source repository.

Key Concept

Cross-account ECR image pulling for ECS Fargate tasks using private VPC endpoints.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic