Examkin

Question

Difficulty: Very hardModernizing Workloads using Containers (ECS and EKS)

ValoLogistics is migrating its on-premises vehicle routing engine to AWS. To comply with strict security standards, the target workload must run on Amazon ECS using AWS Fargate tasks across multiple Availability Zones in a private subnet within the Production account (Account B) with zero direct egress route to the internet. The VPC in Account B has no Internet Gateway or NAT Gateways configured.

Container images are stored in a centralized Amazon ECR repository in a Shared Services account (Account A) and are encrypted using a customer managed AWS KMS key in Account A. The Fargate tasks in Account B must be able to pull these images securely without traversing the public internet, and must also send container logs to Amazon CloudWatch Logs.

Which combination of actions will allow the ECS tasks to pull the images and log successfully? (Select TWO.)

  1. Configure Interface VPC endpoints in Account B's VPC for com.amazonaws.us-east-1.ecr.api, com.amazonaws.us-east-1.ecr.dkr, and com.amazonaws.us-east-1.logs with Private DNS enabled. Create a Gateway VPC endpoint for Amazon S3 and associate it with the route tables of Account B's private subnets.Answer
  2. Update the KMS key policy in Account A to allow the ECS task execution role in Account B kms:Decrypt and kms:DescribeKey permissions. Update the ECR repository policy in Account A to grant the ECS task execution role in Account B permissions for ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage.Answer
  3. C
    Create an IAM policy allowing ECR and KMS decrypt access and attach it to the ECS task role in Account B. Configure the ECS tasks to use the host network mode to bypass the default AWS Fargate container network configuration.
  4. D
    Deploy a single NAT Gateway in one of the private subnets of Account B's VPC, and update the private subnet route tables to forward all egress internet traffic to this NAT Gateway to reach the public ECR and CloudWatch endpoints.
  5. E
    Create a Route 53 Private Hosted Zone (PHZ) for dkr.ecr.us-east-1.amazonaws.com in Account A and associate it with Account B's VPC. Create a Route 53 Resolver outbound endpoint in Account B to forward ECR DNS queries to Account A's Amazon Provided DNS.

Answer

The correct options are configuring the Interface VPC endpoints (ECR API, ECR DKR, CloudWatch Logs) with Private DNS enabled alongside an S3 Gateway endpoint in Account B, and updating both the ECR repository policy and the KMS key policy in Account A to authorize the ECS task execution role in Account B.
To enable AWS Fargate tasks in a fully private VPC (without internet access) to pull images from a cross-account ECR repository and send logs to CloudWatch Logs, two primary requirements must be satisfied: network routing and access permissions. For network routing, Interface VPC endpoints with Private DNS enabled are required for ECR API, ECR DKR, and CloudWatch Logs within the target VPC. Because Amazon ECR stores image layers in Amazon S3, a Gateway VPC endpoint for S3 must also be created and associated with the route tables of the private subnets where the tasks run. For access permissions, since the ECR repository is in another account (Account A) and encrypted with a Customer Managed Key (CMK), the KMS key policy and ECR repository policy in Account A must explicitly allow the ECS Task Execution Role in Account B to decrypt using the KMS CMK and read the ECR repository. Note that the Task Execution Role, not the Task Role, is utilized by the ECS agent/Fargate to perform image pull operations and send logs to CloudWatch.

Step-by-Step Solution

1
Configure VPC network routing for fully private subnets to allow container task bootstrapping.
Interface VPC endpoints are created for com.amazonaws.us-east-1.ecr.api, com.amazonaws.us-east-1.ecr.dkr, and com.amazonaws.us-east-1.logs with Private DNS enabled, and a Gateway VPC endpoint for Amazon S3 is created and associated with the private subnets' route tables.
Since the VPC has no internet access, Fargate requires VPC endpoints to interact with ECR, S3 (where image layers are stored), and CloudWatch Logs.
2
Configure ECR cross-account repository access in Account A.
The ECR repository policy in Account A allows the ECS task execution role in Account B to perform ecr:BatchCheckLayerAvailability, ecr:GetDownloadUrlForLayer, and ecr:BatchGetImage.
Allows the task execution role in the Production account to pull container images from the Shared Services account.
3
Configure KMS cross-account decryption permissions in Account A.
The KMS key policy in Account A allows the ECS task execution role in Account B to perform kms:Decrypt and kms:DescribeKey operations.
Fargate must decrypt the ECR image layers that are encrypted with the customer managed key in Account A during the image pull process.

Key Concept

AWS Fargate cross-account image pulling over private network endpoints
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic