Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

A logistics company, SwiftRoute, is modernizing its on-premises package tracking application by migrating it to Amazon ECS on AWS Fargate. The tasks must be deployed in private subnets, pull container images from Amazon ECR, and write tracking data to Amazon DynamoDB. The company's security policy strictly prohibits the use of NAT Gateways or Internet Gateways. Additionally, the solutions architect must minimize costs and operational overhead. Which configuration should the solutions architect recommend to meet these requirements?

  1. Configure interface VPC endpoints for Amazon ECR and Amazon ECS. Configure gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and associate them with the private subnets' route tables. Run the tasks on AWS Fargate using the awsvpc network mode.Answer
  2. B
    Configure interface VPC endpoints for Amazon ECR, Amazon ECS, and Amazon S3. Configure the ECS task definition to use bridge networking to allow the container instances to share the host's network namespace for DynamoDB traffic.
  3. C
    Configure a single NAT Gateway in a public subnet, and update the route table of the private subnets to route all outbound traffic through the NAT Gateway to access Amazon ECR and Amazon DynamoDB.
  4. D
    Configure interface VPC endpoints for Amazon ECR and Amazon ECS. Create a Route 53 Private Hosted Zone for Amazon DynamoDB and Amazon S3, and associate it with the VPC to resolve public endpoints to private IP addresses.

Answer

Configure interface VPC endpoints for Amazon ECR and Amazon ECS. Configure gateway VPC endpoints for Amazon S3 and Amazon DynamoDB, and associate them with the private subnets' route tables. Run the tasks on AWS Fargate using the awsvpc network mode.
The correct configuration uses interface VPC endpoints for ECR and ECS, and gateway VPC endpoints for S3 and DynamoDB. Fargate tasks run in the awsvpc network mode and require direct private network paths to access AWS APIs. ECR stores image layers in S3, requiring the S3 gateway endpoint. Gateway endpoints for S3 and DynamoDB are highly cost-effective and have no hourly fees, matching the low-cost requirement.

Step-by-Step Solution

1
Identify the networking requirements for AWS Fargate tasks running in private subnets without public internet routes.
Recognize that the tasks require private network connectivity to Amazon ECR, Amazon ECS, Amazon S3, and Amazon DynamoDB.
Since NAT Gateways and Internet Gateways are prohibited, VPC endpoints must be used to keep traffic internal to the AWS network.
2
Determine the type of VPC endpoints required for each service.
Amazon ECR and Amazon ECS require interface VPC endpoints. Amazon S3 and Amazon DynamoDB support gateway VPC endpoints, which do not incur hourly charges.
Using gateway endpoints for S3 and DynamoDB is the most cost-effective and operationally simple method.
3
Verify Fargate network compatibility constraints.
Ensure that the tasks are configured with the awsvpc network mode, which is the only network mode supported by AWS Fargate.
Bridge and host network modes are unsupported on AWS Fargate and would fail during task execution.

Key Concept

AWS Fargate private networking with ECR, ECS, and DynamoDB using VPC Endpoints
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic