Examkin

Question

Difficulty: Very hardModernizing Workloads using Containers (ECS and EKS)

NexaSettlement Corp is modernizing its core clearing and settlement engine by migrating it from on-premises virtual machines to AWS. The settlement engine is memory-intensive and must run on AWS Fargate across three Availability Zones in a dedicated Workload account. The engine must query a real-time audit logger hosted in a Shared Services account.

The architecture must adhere to the following constraints:
1. All traffic between the settlement engine, the audit logger, and AWS services must remain within the AWS network to satisfy PCI-DSS compliance.
2. The settlement engine must pull container images from a private Amazon ECR repository located in the Shared Services account.
3. The settlement engine must resolve the audit logger's internal DNS name, which is managed in a Route 53 Private Hosted Zone (PHZ) in the Shared Services account.
4. The system must tolerate the failure of any single Availability Zone or NAT Gateway without service interruption.

Which design meets these requirements with the least operational overhead?

  1. Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode. Create VPC interface endpoints for Amazon ECR (ecr.api and ecr.dkr) and a VPC gateway endpoint for Amazon S3 in the Workload VPC. Configure the ECR repository policy in the Shared Services account to allow access from the Workload account's ECS task execution role. Create a Route 53 Private Hosted Zone association authorization in the Shared Services account, and associate the zone with the Workload VPC using the AWS CLI.Answer
  2. B
    Deploy the settlement engine tasks in the Workload VPC using the bridge network mode to simplify local port mapping. Set up an AWS Transit Gateway to route container traffic to Amazon ECR VPC endpoints located in the Shared Services VPC. Configure Route 53 Resolver outbound endpoints in the Workload VPC and inbound endpoints in the Shared Services VPC to forward DNS queries for the audit logger.
  3. C
    Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode. Deploy a single NAT Gateway in the public subnet of one Availability Zone to route ECR and S3 image pull requests to public endpoints. Authorize the Workload ECS tasks to assume a cross-account IAM role in the Shared Services account to perform DNS resolution against the Private Hosted Zone.
  4. D
    Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode. Create VPC interface endpoints for Amazon ECR and a VPC gateway endpoint for Amazon S3 in the Workload VPC, using AWS-managed KMS keys (aws/s3 and aws/ecr) for encryption. Create Route 53 Resolver outbound endpoints in the Workload VPC and inbound endpoints in the Shared Services VPC to resolve the audit logger DNS.

Answer

Deploy the settlement engine tasks in the Workload VPC using the awsvpc network mode, create VPC interface endpoints for Amazon ECR and a gateway endpoint for Amazon S3 in the Workload VPC, configure the ECR repository policy in the Shared Services account to grant access to the Workload account's ECS task execution role, and associate the Route 53 Private Hosted Zone directly with the Workload VPC using the AWS CLI or API.
Deploying the settlement engine on AWS Fargate using the awsvpc network mode is required. Creating interface endpoints for ECR and a gateway endpoint for S3 inside the Workload VPC allows the tasks to pull container images privately without requiring public internet routing. Configuring the ECR repository policy in the Shared Services account ensures that the Workload account's ECS task execution role has appropriate permissions. Associating the Route 53 Private Hosted Zone in the Shared Services account with the Workload VPC using the AWS CLI provides direct, native private DNS resolution with minimal operational complexity.

Step-by-Step Solution

1
Select the correct network mode for AWS Fargate.
Confirm that the task definitions are configured to use the awsvpc network mode, as AWS Fargate does not support other modes like host or bridge.
Ensures that the containers can be deployed successfully on the serverless compute engine.
2
Configure private connectivity to Amazon ECR and S3.
Provision VPC interface endpoints for ecr.api and ecr.dkr, and a VPC gateway endpoint for S3 in the Workload VPC.
Allows the ECS agent on Fargate to pull container images privately without traversing the public internet or incurring NAT Gateway costs, complying with PCI-DSS.
3
Establish cross-account ECR access permissions.
Attach a repository policy to the ECR repository in the Shared Services account allowing 'ecr:BatchGetImage' and 'ecr:GetDownloadUrlForLayer' to the ECS task execution role in the Workload account.
Grants the ECS tasks in the Workload account the required permissions to pull the image from the Shared Services account.
4
Associate the Route 53 Private Hosted Zone (PHZ) across accounts.
Submit a PHZ association authorization from the Shared Services account, and then accept the association for the Workload VPC from the Workload account using the AWS CLI or API.
Enables local tasks in the Workload VPC to resolve the internal DNS of the audit logger directly without deploying complex Route 53 Resolver architectures.

Key Concept

Modernizing legacy workloads to AWS Fargate requires leveraging the awsvpc network mode, utilizing local VPC endpoints (ECR and S3) for private image pulls from other AWS accounts, and executing cross-account Route 53 Private Hosted Zone associations for internal DNS resolution.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic