Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

AeroSpire Systems is modernizing its core ERP microservices by migrating them from on-premises virtual machines to Amazon EKS. The target architecture spans two AWS accounts: a Shared Services account and a Production account. In the Production account, the Amazon EKS cluster runs worker nodes in private subnets across three Availability Zones (AZs). The worker nodes must pull container images from a private Amazon ECR repository in the Shared Services account, and resolve internal endpoints via a Route 53 Private Hosted Zone (PHZ) managed in the Shared Services account. For security compliance, the Production VPC has no direct internet route; instead, all outbound internet traffic must route through a central egress VPC in the Shared Services account via AWS Transit Gateway. The application requires high availability with an Active-Active multi-AZ deployment to meet a Recovery Time Objective (RTO) of less than 1 minute. Which configuration should the Solutions Architect implement to meet these requirements with the minimum operational overhead?

  1. A
    Configure EKS worker nodes to run on AWS Fargate using host networking to bypass virtual interface overhead. Associate the Route 53 Private Hosted Zone with the Production VPC. Deploy a single NAT Gateway in the central egress VPC, and configure route tables to route all outbound traffic from the Production VPC to the central egress VPC via Transit Gateway.
  2. B
    Create interface VPC endpoints for Amazon ECR and a gateway VPC endpoint for Amazon S3 in the Production VPC. Rely on the default AWS-managed DNS in the Production VPC to resolve the Route 53 Private Hosted Zone without explicit VPC association. Deploy a NAT Gateway in each Availability Zone in the central egress VPC, and configure a Direct Connect Gateway to perform transitive routing for outbound traffic.
  3. Create interface VPC endpoints for Amazon ECR and a gateway VPC endpoint for Amazon S3 in the Production VPC. Associate the Route 53 Private Hosted Zone with the Production VPC. Deploy a NAT Gateway in each of the three Availability Zones in the central egress VPC, and configure the Route Tables and Transit Gateway to route all outbound traffic through them.Answer
  4. D
    Create interface VPC endpoints for Amazon ECR and a gateway VPC endpoint for Amazon S3 in the Production VPC. Associate the Route 53 Private Hosted Zone with the Production VPC. Implement a Pilot Light disaster recovery strategy by deploying the Amazon EKS worker nodes in a single Availability Zone, and route outbound traffic through a single NAT Gateway in the egress VPC via Transit Gateway.

Answer

The correct answer states that interface VPC endpoints for Amazon ECR and a gateway endpoint for Amazon S3 must be created in the Production VPC, the Route 53 Private Hosted Zone must be associated with the Production VPC, and redundant NAT Gateways must be deployed in each Availability Zone in the central egress VPC with routing configured via Transit Gateway.
To securely pull images from a private ECR repository in another account without internet access, EKS worker nodes require interface VPC endpoints for ECR (api and dkr) and a gateway endpoint for S3 (since ECR storing layers uses S3). For DNS resolution, a Route 53 Private Hosted Zone hosted in a Shared Services account must be explicitly associated with the client VPC (Production VPC) to allow DNS query resolution. To maintain high availability and prevent a single point of failure for outbound internet traffic, a NAT Gateway must be deployed in each Availability Zone of the central egress VPC, and Transit Gateway should route outbound traffic dynamically.

Step-by-Step Solution

1
Configure private container registry access for EKS worker nodes.
Interface VPC endpoints for Amazon ECR (api and dkr) and a gateway VPC endpoint for Amazon S3 are deployed in the Production VPC.
Since the Production VPC has no internet access, the worker nodes must access Amazon ECR via local VPC endpoints. ECR stores its image layers in S3, which necessitates the S3 gateway endpoint.
2
Enable cross-account DNS resolution for internal service endpoints.
The Route 53 Private Hosted Zone from the Shared Services account is associated with the Production VPC.
EKS pods and worker nodes in the Production VPC cannot resolve hostnames within the Private Hosted Zone unless it is associated with the client VPC.
3
Establish highly available egress routing for third-party traffic.
Transit Gateway routes the 0.0.0.0/0 traffic from the Production VPC to the central egress VPC, which has one NAT Gateway per Availability Zone.
To ensure active-active high availability and meet the low RTO requirement, NAT Gateways must be deployed redundantly across all Availability Zones in the egress path.

Key Concept

Designing secure, highly available, and isolated container architectures using EKS with cross-account resources, private hosted zones, and Transit Gateway routing.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic