A retail enterprise, NovaCart Solutions, is modernizing its legacy order processing application by migrating it to AWS. The application will be deployed on Amazon ECS using the AWS Fargate launch type. The tasks must run in private subnets with no public IP addresses assigned. The application needs to pull container images from a central Amazon ECR repository located in a Shared Services AWS account. This ECR repository is encrypted at rest. Additionally, the application must connect to external payment gateway APIs over the public internet to authorize transactions. The architecture must be highly available and follow AWS security best practices. Which TWO actions should the solutions architect take to meet these requirements?
- Deploy the ECS tasks in private subnets using the awsvpc network mode, and route outbound internet traffic through redundant NAT Gateways deployed in public subnets across multiple Availability Zones.Answer
- Configure the central ECR repository to use a customer managed KMS key, and grant decrypt permissions to the ECS task execution role in the application account via the KMS key policy.Answer
- CDeploy the ECS tasks using the host network mode on AWS Fargate to reduce latency and allow direct binding to the underlying virtual machine network interface.
- DConfigure the central ECR repository to use the default AWS-managed KMS key (aws/ecr) and attach an IAM policy to the ECS task execution role in the application account to allow decryption of the central key.
- EDeploy the ECS tasks in private subnets and configure all subnets to route outbound traffic through a single NAT Gateway in one Availability Zone to minimize NAT Gateway hourly charges.
- FCreate a Route 53 Private Hosted Zone for ECR in the Shared Services account and rely on automatic cross-VPC DNS resolution for all accounts belonging to the AWS Organization.
Answer
The correct strategy is to deploy the Fargate tasks using the awsvpc network mode with outbound internet traffic routed through redundant NAT Gateways across multiple Availability Zones, and to encrypt the central ECR repository using a customer managed KMS key that grants cross-account decrypt permissions via its key policy.
Deploying the ECS tasks in private subnets using the awsvpc network mode with traffic routed through redundant NAT Gateways satisfies the networking constraints of Fargate while preserving high availability. Utilizing a customer managed KMS key with a cross-account key policy allows the application account's task execution role to decrypt and pull the container images securely from the central Shared Services account.
Step-by-Step Solution
Key Concept
Amazon ECS Fargate network architecture limits task execution to the awsvpc network mode. In cross-account scenarios where container images are encrypted in central repositories, default AWS-managed KMS keys cannot be shared, requiring customer managed keys with explicit cross-account permissions.