Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

An online retail company, ShopVibe, is modernizing its legacy order processing application to run on AWS. The application consists of a frontend service and an order validation service. The modernization strategy requires migrating the application to Amazon ECS using the AWS Fargate launch type to minimize operational overhead. The database hosting the order data remains on-premises, accessed via an AWS Direct Connect connection. The validation service must communicate with the frontend service with low latency and must not be exposed to the public internet. Security policies dictate that all inter-container traffic must be encrypted, and container task execution roles must follow the principle of least privilege. Which TWO configurations must a Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Configure the Amazon ECS tasks using the awsvpc network mode inside private subnets, and enable ECS Service Connect with TLS encryption for secure, internal service-to-service communication.Answer
  2. Provision distinct ECS Task Execution Roles for pulling images and secrets, and distinct ECS Task Roles specifying minimal permissions for runtime access to external resources like the on-premises database.Answer
  3. C
    Configure the ECS tasks to use the bridge network mode to enable dynamic port mapping on the underlying host, facilitating container-to-container communication.
  4. D
    Create a single Route 53 Private Hosted Zone for internal DNS resolution in a centralized management VPC without associating it with the task VPC.
  5. E
    Place the tasks in a single Availability Zone and deploy a single NAT Gateway in that zone to handle all outbound database synchronization requests.

Answer

To meet the requirements, the Solutions Architect should configure the Amazon ECS tasks using the awsvpc network mode inside private subnets with ECS Service Connect and TLS, and provision distinct ECS Task Execution Roles and ECS Task Roles.
The correct configurations involve using the awsvpc network mode (which is required by AWS Fargate) paired with ECS Service Connect for encrypted private traffic, and establishing separate task execution and runtime task roles to maintain least privilege.

Step-by-Step Solution

1
Determine the supported network mode for AWS Fargate containers.
Fargate tasks require the awsvpc network mode, which provides a dedicated elastic network interface (ENI) for each task.
Bridge or host networking modes are incompatible with AWS Fargate.
2
Configure secure, private communication between services.
Enable ECS Service Connect with TLS, which handles service discovery and encrypts container-to-container traffic automatically within the VPC.
Service Connect bypasses the public internet and fulfills the encryption requirement without manual SSL certificate management.
3
Apply security permissions following least privilege.
Establish separate IAM roles: the Task Execution Role for ECS agent permissions (e.g., pulling images, reading secrets) and the Task Role for the container application runtime (e.g., communicating with the database).
Separating these roles prevents credential exposure and restricts runtime environments to only necessary resources.

Key Concept

Fargate networking constraints and proper configuration of IAM roles for least-privilege task security.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic