Examkin

Question

Difficulty: Very hardModernizing Workloads using Containers (ECS and EKS)

ZetaDiagnostics is migrating its HIPAA-compliant medical image processing engine from an on-premises virtualized environment to AWS. The target architecture must run on AWS Fargate across three Availability Zones to minimize operational overhead. The workload VPC is connected to a central shared services VPC via AWS Transit Gateway. The containers must securely pull images from an Amazon Elastic Container Registry (Amazon ECR) repository located in the shared services VPC without traversing the public internet. Additionally, the Fargate tasks must retrieve encrypted clinical parameters from AWS Secrets Manager using a key managed in the shared services account. All internal DNS queries for ECR must resolve directly to the shared services VPC endpoints. Which combination of architectural steps will satisfy these requirements? (Select TWO.)

  1. Configure the ECS task definition to use the awsvpc network mode. In the shared services account, associate the Route 53 Private Hosted Zone for the ECR VPC endpoints with the workload VPC. Update the ECR repository policy in the shared services account to grant the task execution role in the workload account permission to pull the container images.Answer
  2. B
    Configure the ECS task definition to use the bridge network mode to enable resource sharing. Set up a Route 53 Resolver forwarding rule in the workload VPC to route ECR DNS queries to the default public Route 53 resolver, and configure the workloads to pull images over AWS Direct Connect.
  3. Update the Secrets Manager secret resource policy and the KMS Customer Managed Key (CMK) key policy in the shared services account to grant retrieve and decrypt permissions to the workload task execution role. In the workload account, configure the task execution role with permissions to read the secret and decrypt using the CMK, and reference the cross-account secret ARN in the task container definition.Answer
  4. D
    Encrypt the Secrets Manager secret in the shared services account using the AWS-managed KMS key for Secrets Manager. Configure the task execution role in the workload account with access to the AWS-managed key, and configure the ECS tasks to use the host network mode for direct container communication.
  5. E
    Create a new Route 53 Private Hosted Zone for ECR in the workload account. Configure a Transit Gateway static route directing ECR DNS traffic to a NAT Gateway in the workload VPC, and use a Customer Managed Key (CMK) without cross-account policy configuration to decrypt the configuration secrets.

Answer

To implement this architecture, you must configure the ECS task definition to use the awsvpc network mode, associate the shared services Route 53 Private Hosted Zone for ECR with the workload VPC, and grant cross-account ECR repository permissions. Additionally, you must update the Secrets Manager secret policy and KMS Customer Managed Key key policy to trust the workload task execution role, and reference the cross-account secret ARN in the task container definition.
The correct solution steps resolve both ECR connectivity and Secrets Manager decryption constraints. First, AWS Fargate tasks strictly require the awsvpc network mode. For cross-account ECR access, the Route 53 Private Hosted Zone hosted in the shared services account must be associated with the workload VPC, allowing tasks to resolve ECR endpoints privately. The shared ECR repository policy must also permit the workload task execution role to pull images. Second, cross-account access to Secrets Manager requires a Customer Managed Key (CMK) because the default AWS-managed KMS key key policy cannot be edited to trust an external account. Both the secret policy and the CMK key policy in the shared services account must grant access to the workload account's task execution role, which is referenced in the container definition.

Step-by-Step Solution

1
Enforce AWS Fargate networking constraints by choosing the awsvpc network mode.
Task definitions are validated and can run on AWS Fargate.
AWS Fargate strictly supports only the awsvpc network mode.
2
Establish secure cross-account ECR DNS resolution and repository access.
The Fargate tasks resolve and pull images from ECR privately.
Associating the shared services Route 53 Private Hosted Zone with the workload VPC enables local DNS resolution of the ECR endpoints without internet traversal.
3
Enable cross-account Secrets Manager access using Customer Managed Keys.
The Fargate tasks successfully retrieve and decrypt sensitive parameters.
AWS-managed KMS keys do not support policy modification for cross-account access, necessitating a Customer Managed Key with explicit trust policies in the shared services account.

Key Concept

Cross-account container modernization using AWS Fargate, including awsvpc networking constraints, private ECR access over Route 53 PHZ associations, and cross-account Secrets Manager decryption using Customer Managed Keys (CMKs).
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic