Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

Zephyr Retail is modernizing its on-premises containerized inventory microservice by migrating it to AWS. To adhere to strict security and compliance standards, the Production environment must be isolated inside a private subnet of a Production VPC with no route to the internet, and no NAT Gateways are permitted. The modernized containerized application must run on AWS Fargate using Amazon Elastic Container Service (Amazon ECS). Additionally, container images must be pulled from a centralized, Shared Services AWS account using an Amazon Elastic Container Registry (Amazon ECR) repository. The application must achieve high availability across multiple Availability Zones, with the container deployment mechanism configured to authenticate and pull images securely without traversing the public internet. Which of the following configurations will allow the ECS tasks in the Production VPC to successfully pull the container images from the Shared Services account's ECR repository?

  1. A
    Configure the Amazon ECS task definition to use the bridge network mode. In the Production VPC, create interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr, and a gateway VPC endpoint for Amazon S3. Configure the ECS task execution IAM role in the Production account to allow ECR pull actions, and configure the ECR repository policy in the Shared Services account to grant read permissions.
  2. B
    Configure the Amazon ECS task definition to use the awsvpc network mode. In the Production VPC, create interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr, and a gateway VPC endpoint for Amazon S3. Configure the Shared Services account to encrypt the ECR repository using the default AWS-managed KMS key (aws/ecr), and update its key policy to allow cross-account decrypt permissions for the Production ECS task execution role.
  3. Configure the Amazon ECS task definition to use the awsvpc network mode. In the Production VPC, create interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr, and a gateway VPC endpoint for Amazon S3. Configure the ECS task execution IAM role in the Production account to allow ECR pull actions, and configure the ECR repository policy in the Shared Services account to grant read permissions to the Production account.Answer
  4. D
    Configure the Amazon ECS task definition to use the awsvpc network mode. Create a Route 53 Private Hosted Zone for dkr.ecr.region.amazonaws.com in the Shared Services account. Create interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr in the Production VPC, but do not associate the Private Hosted Zone with the Production VPC.

Answer

The configuration that uses the awsvpc network mode for ECS Fargate tasks, creates ECR interface endpoints and an S3 gateway endpoint in the Production VPC, and sets up cross-account access via IAM execution roles and ECR repository policies.
The correct configuration uses the awsvpc network mode, which is mandatory for AWS Fargate. It also creates interface VPC endpoints for the Amazon ECR APIs (ecr.api and ecr.dkr) and the gateway endpoint for Amazon S3, which is required because ECR stores image layers in S3. Finally, it sets up cross-account access by configuring the ECS task execution role in the Production account and granting read access in the ECR repository policy in the Shared Services account.

Step-by-Step Solution

1
Ensure container networking compatibility on Fargate
The ECS task definition is configured to use the awsvpc network mode, which is the only network mode supported by AWS Fargate.
AWS Fargate does not support bridge or host network modes.
2
Set up private connectivity in the VPC without internet access
Create com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr Interface VPC Endpoints, and a Gateway VPC Endpoint for Amazon S3 in the Production VPC.
The ECR API calls are routed through the interface endpoints, while the actual image layer downloads (which ECR stores in S3 under the hood) are routed through the S3 gateway endpoint.
3
Configure cross-account IAM and ECR repository permissions
The Production account's ECS task execution role is given permissions to perform ecr:GetDownloadUrlForLayer, ecr:BatchGetImage, and ecr:BatchCheckLayerAvailability. The ECR repository policy in the Shared Services account is updated to trust the Production account/role.
By default, cross-account access to ECR repositories requires explicit permissions on both the pulling IAM role and the destination ECR repository policy.

Key Concept

Cross-account ECR image pulling with ECS on AWS Fargate in private VPCs using VPC endpoints
Estimated Time:2m 0s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic