Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

NovaTrade Brokerage is modernizing its legacy transaction clearing system by migrating it from on-premises servers to AWS. The workload consists of multiple microservices that must run on AWS Fargate to minimize operational overhead. The microservices must securely communicate with each other using internal DNS names within a multi-VPC environment spanning two AWS accounts: Account A (a shared services account) and Account B (the application workload account). The workload VPC in Account B spans three Availability Zones and hosts the containers in private subnets. The microservices must also securely call external payment APIs over the internet. Additionally, to comply with financial audits, all container logs must be encrypted in Amazon CloudWatch Logs using a Customer Managed Key (CMK) in AWS KMS.

Which architectural design meets these requirements while ensuring high availability for outbound traffic?

  1. A
    Deploy the microservices on AWS Fargate using the bridge network mode to enable dynamic host port mapping. In the workload VPC, deploy a NAT Gateway in a public subnet in each of the three Availability Zones, routing outbound internet traffic from the private subnets to their respective local NAT Gateway. Create a Route 53 Private Hosted Zone in Account A, authorize and associate it with the workload VPC in Account B. Configure CloudWatch Logs with a Customer Managed Key (CMK), granting permissions to the CloudWatch Logs service principal in the key policy.
  2. Deploy the microservices on AWS Fargate using the awsvpc network mode. In the workload VPC, deploy a NAT Gateway in a public subnet in each of the three Availability Zones, routing outbound internet traffic from the private subnets to their respective local NAT Gateway. Create a Route 53 Private Hosted Zone in Account A, authorize and associate it with the workload VPC in Account B. Configure CloudWatch Logs with a Customer Managed Key (CMK), granting permissions to the CloudWatch Logs service principal in the key policy.Answer
  3. C
    Deploy the microservices on AWS Fargate using the awsvpc network mode. In the workload VPC, deploy a NAT Gateway in a public subnet in each of the three Availability Zones, routing outbound internet traffic from the private subnets to their respective local NAT Gateway. Create a Route 53 Private Hosted Zone in Account A, assuming it is automatically accessible by all VPCs within the AWS Organization without explicit cross-account association. Configure CloudWatch Logs with a Customer Managed Key (CMK), granting permissions to the CloudWatch Logs service principal in the key policy.
  4. D
    Deploy the microservices on AWS Fargate using the awsvpc network mode. In the workload VPC, deploy a single NAT Gateway in a public subnet within one Availability Zone, routing outbound internet traffic from all private subnets across all three Availability Zones to this single NAT Gateway. Create a Route 53 Private Hosted Zone in Account A, authorize and associate it with the workload VPC in Account B. Configure CloudWatch Logs with a Customer Managed Key (CMK), granting permissions to the CloudWatch Logs service principal in the key policy.

Answer

Deploying the microservices on AWS Fargate in the awsvpc network mode, deploying redundant NAT Gateways across all three Availability Zones, configuring a cross-account Route 53 Private Hosted Zone association, and encrypting CloudWatch Logs with a Customer Managed Key.
The correct architectural design involves deploying the microservices on AWS Fargate using the awsvpc network mode, since AWS Fargate does not support other modes. To ensure high availability and prevent a single point of failure, a separate NAT Gateway must be deployed in a public subnet in each of the three Availability Zones. To resolve DNS names across the two AWS accounts, the Route 53 Private Hosted Zone in Account A must be explicitly associated with the workload VPC in Account B. Finally, to encrypt CloudWatch Logs with a Customer Managed Key, the KMS key policy must explicitly allow the CloudWatch Logs service principal to access the key.

Step-by-Step Solution

1
Determine container networking mode on AWS Fargate
Identify that only the awsvpc network mode is supported by AWS Fargate, which allocates an Elastic Network Interface (ENI) to each task.
Choosing the bridge network mode will cause deployment failure on Fargate.
2
Configure high availability for outbound internet connectivity
Deploy three NAT Gateways (one per Availability Zone) in the public subnets and update the private subnet route tables to target the local NAT Gateway in the same zone.
A single NAT Gateway creates a single point of failure if that specific Availability Zone goes down, failing the high availability requirement.
3
Configure cross-account internal DNS resolution
Create a Route 53 Private Hosted Zone in Account A, authorize the VPC in Account B to associate with it, and then accept the association from Account B.
Private Hosted Zones are private to the associated VPCs and do not cross account boundaries automatically without explicit association.
4
Configure log encryption with a Customer Managed Key
Create a KMS Customer Managed Key, configure a key policy allowing the CloudWatch Logs service principal to perform encrypt/decrypt actions, and associate the key with the log group.
AWS-managed keys (like aws/logs) cannot have their policies modified to allow cross-account or service-specific custom grants, necessitating a Customer Managed Key.

Key Concept

Modernizing legacy workloads using Amazon ECS on AWS Fargate requires understanding network limitations (awsvpc only), multi-account DNS integration via cross-account Route 53 Private Hosted Zone associations, high availability outbound routing using redundant NAT Gateways, and compliance logging using KMS Customer Managed Keys.
Estimated Time:3m 0s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic