Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

AeroWing Engineering is migrating its telemetry parsing system to AWS. The system consists of multiple microservices that need to run on Amazon ECS using AWS Fargate. The microservices must run in private subnets with no internet access. The services need to resolve the internal domain names of other services hosted in a separate VPC inside the same AWS organization. A Route 53 private hosted zone has been created for these internal domains in the shared services VPC. The ECS tasks must also pull container images from Amazon ECR and fetch application secrets from AWS Secrets Manager.

Which configurations must the Solutions Architect implement to meet these requirements? (Select TWO.)

  1. Associate the Route 53 private hosted zone in the shared services VPC with the ECS VPC, and enable DNS resolution and DNS hostnames in the ECS VPC.Answer
  2. Configure the ECS task definition to use the awsvpc network mode, and deploy interface VPC endpoints for Amazon ECR and AWS Secrets Manager, along with a gateway VPC endpoint for Amazon S3, within the ECS VPC.Answer
  3. C
    Configure the ECS task definition to use the bridge network mode to map container ports to host ports, and route the tasks' external traffic through a Transit Gateway to pull ECR images.
  4. D
    Create a Route 53 resolver rule in the ECS VPC to forward queries for the internal domain to the inbound resolver endpoint in the shared services VPC, without associating the private hosted zone.
  5. E
    Deploy a single NAT Gateway in a public subnet of the ECS VPC and configure the ECS task definition to use host network mode to enable direct routing of task traffic to the NAT Gateway.

Answer

The correct configurations are: (1) Associate the Route 53 private hosted zone in the shared services VPC with the ECS VPC, and enable DNS resolution and DNS hostnames in the ECS VPC; and (2) Configure the ECS task definition to use the awsvpc network mode, and deploy interface VPC endpoints for Amazon ECR and AWS Secrets Manager, along with a gateway VPC endpoint for Amazon S3, within the ECS VPC.
To support containerized microservices running on AWS Fargate in a fully isolated VPC with no internet access, interface VPC endpoints (PrivateLink) must be deployed for Amazon ECR and AWS Secrets Manager, and a gateway VPC endpoint is required for Amazon S3. Fargate tasks must use the awsvpc network mode because Fargate does not support other modes. To resolve the internal domains hosted in the shared services VPC, the private hosted zone must be associated with the ECS VPC, and DNS hostnames and DNS resolution must be enabled within that VPC.

Step-by-Step Solution

1
Determine the network mode and endpoint configuration for ECS tasks on AWS Fargate.
Identify that AWS Fargate tasks require the awsvpc network mode. Since the subnets are private without internet access, PrivateLink interface endpoints must be set up for Amazon ECR (api and dkr) and AWS Secrets Manager, alongside a gateway endpoint for Amazon S3 to fetch container image layers.
Tasks on Fargate cannot use bridge or host network modes. Because they run in private subnets with no internet routes, they must connect to AWS services privately via VPC endpoints.
2
Determine how to resolve internal domain names managed by Route 53 in a shared services VPC.
Establish a cross-VPC association between the Route 53 private hosted zone and the ECS VPC. Ensure that DNS resolution and DNS hostnames are enabled on the ECS VPC.
Route 53 private hosted zones cannot be resolved by default across VPC boundaries without an explicit association, even if the VPCs are peered or belong to the same AWS Organization.

Key Concept

Modernizing legacy workloads using ECS Fargate requires configuring tasks with the awsvpc network mode and establishing private service connectivity via VPC endpoints in isolated network environments, alongside proper cross-VPC Route 53 private hosted zone associations.

Alternative Method

Instead of using interface VPC endpoints for ECR and Secrets Manager directly in the ECS VPC, a private transit VPC or a shared VPC architecture could be implemented. In this model, interface endpoints are hosted centrally, and traffic is routed via AWS Transit Gateway, reducing endpoint cost across multiple VPCs while maintaining strict isolation from the public internet.
Estimated Time:2m 30s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic