Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

An insurance firm is modernizing its legacy claims validation backend application by migrating it from on-premises virtual machines to AWS. The proposed architecture requires deploying the application as containerized tasks using the AWS Fargate launch type on Amazon ECS. The tasks must run in a private subnet of an application VPC with no direct outbound path to the internet. The container images must be securely pulled from a centralized Amazon Elastic Container Registry (ECR) repository located in a shared services VPC within the same AWS Organization. A Route 53 Private Hosted Zone for ECR has been created and is hosted in the shared services VPC. Which TWO configurations must a Solutions Architect implement to allow the ECS tasks to pull images from ECR without traversing the public internet? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zone from the shared services VPC with the application VPC.Answer
  2. Create Interface VPC Endpoints for Amazon ECR and a Gateway VPC Endpoint for Amazon S3 in the application VPC.Answer
  3. C
    Configure the ECS task definition to use host network mode to route traffic directly to the shared services VPC.
  4. D
    Set up an AWS Transit Gateway to route DNS queries transitively to the Route 53 Private Hosted Zone without VPC association.
  5. E
    Deploy a single NAT Gateway in the application VPC to route image pull traffic to the public ECR service endpoints.

Answer

Associate the Route 53 Private Hosted Zone from the shared services VPC with the application VPC, and create Interface VPC Endpoints for Amazon ECR and a Gateway VPC Endpoint for Amazon S3 in the application VPC.
To pull container images from Amazon ECR without internet access, ECS Fargate tasks—which require the awsvpc network mode—must resolve ECR endpoints privately. This is achieved by creating Interface VPC Endpoints for ECR (ecr.api and ecr.dkr) in the application VPC, and a Gateway VPC Endpoint for Amazon S3 because ECR stores image layers in S3. Additionally, the Route 53 Private Hosted Zone managing the private DNS records for ECR in the shared services VPC must be associated with the application VPC so that tasks can resolve the ECR DNS names to the private IP addresses of the interface endpoints.

Step-by-Step Solution

1
Enable DNS resolution across the accounts by associating the Route 53 Private Hosted Zone with the application VPC.
The application VPC is authorized to resolve ECR endpoint names to private IP addresses.
By default, a Private Hosted Zone is only resolvable within the VPCs with which it is associated.
2
Provision VPC Endpoints for Amazon ECR (ecr.api and ecr.dkr) in the application VPC.
Network endpoints are established inside the application VPC's subnets.
This allows Fargate tasks to communicate with ECR API and download image manifests privately.
3
Provision a Gateway VPC Endpoint for Amazon S3 in the application VPC.
Secure, private routing to S3 is enabled for the application VPC subnets.
Amazon ECR hosts the container image layers in Amazon S3 buckets, meaning tasks must also have private access to S3 to successfully download the image layers.

Key Concept

Private container image retrieval in AWS ECS Fargate requires Interface VPC Endpoints for ECR API and registry endpoints, a Gateway VPC Endpoint for S3 where layers reside, and cross-VPC association of Route 53 Private Hosted Zones.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic