Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

BioPharma Nexus is modernizing its legacy drug discovery simulation application by migrating it from on-premises servers to Amazon ECS on AWS Fargate. The application is deployed across multiple private subnets in a Workload VPC. The container images are hosted in an Amazon ECR repository in a centralized Shared Services AWS account. The tasks also retrieve database credentials from AWS Secrets Manager in the Workload account, which are encrypted using a customer managed AWS KMS key in the Workload account.

To comply with strict security standards, no internet gateways or NAT gateways are allowed in either VPC. An AWS Transit Gateway connects the Workload VPC and the Shared Services VPC. Interface VPC endpoints for ECR (api and dkr), Secrets Manager, and KMS are established in the Shared Services VPC. The Route 53 Private Hosted Zones (PHZs) for these endpoints are currently associated only with the Shared Services VPC.

When deploying the ECS tasks in the Workload VPC, they fail to transition to the RUNNING state, displaying the error: 'ResourceInitializationError: unable to pull secrets or registry auth'.

Which of the following solutions will resolve the initialization error and allow the tasks to run successfully?

  1. A
    Associate the ECR, Secrets Manager, and KMS Private Hosted Zones with the Workload VPC. Create an S3 Gateway VPC endpoint in the Shared Services VPC, and add a route in the Workload VPC route tables directing S3-bound traffic to the Transit Gateway.
  2. Associate the ECR, Secrets Manager, and KMS Private Hosted Zones with the Workload VPC. Create an S3 Gateway VPC endpoint in the Workload VPC and associate it with the Workload VPC route tables. Ensure the ECS task execution role has permissions to pull ECR images, retrieve the Secrets Manager secret, and decrypt it using the customer managed KMS key.Answer
  3. C
    Modify the ECS task definition to use host network mode to allow the container to bypass Fargate VPC endpoint restrictions. Associate the ECR, Secrets Manager, and KMS Private Hosted Zones with the Workload VPC, and create an S3 Gateway VPC endpoint in the Shared Services VPC.
  4. D
    Create ECR, Secrets Manager, and KMS Interface VPC endpoints locally in the Workload VPC. Configure the ECS tasks to use the default AWS-managed KMS key (aws/secretsmanager) to decrypt the database credentials, and update the key policy in the Workload account to trust the Workload task execution role.

Answer

Associate the ECR, Secrets Manager, and KMS Private Hosted Zones with the Workload VPC, create an S3 Gateway VPC endpoint locally in the Workload VPC, and ensure the ECS task execution role has the necessary ECR, Secrets Manager, and customer managed KMS key permissions.
The correct solution involves associating the Private Hosted Zones of the centralized ECR, Secrets Manager, and KMS endpoints with the Workload VPC so that the tasks can resolve their DNS names privately. Additionally, because Amazon ECR stores image layers in Amazon S3, and S3 Gateway VPC endpoints cannot be transitively accessed over AWS Transit Gateway, a local S3 Gateway VPC endpoint must be created in the Workload VPC. Finally, the ECS task execution role must be granted permissions to pull from ECR, read the Secrets Manager secret, and decrypt it using the customer managed KMS key.

Step-by-Step Solution

1
Associate the Route 53 Private Hosted Zones (PHZs) for ECR, Secrets Manager, and KMS from the Shared Services VPC with the Workload VPC.
Enables ECS Fargate tasks in the Workload VPC to resolve ECR, Secrets Manager, and KMS endpoint DNS names to the private IP addresses of the endpoints in the Shared Services VPC.
PHZs must be explicitly associated with any VPC that needs private DNS resolution for those names.
2
Create a Gateway VPC Endpoint for Amazon S3 in the Workload VPC and associate it with the Workload VPC subnet route tables.
Allows ECS Fargate tasks to directly download container image layers from Amazon S3 over the private AWS network.
Amazon ECR stores image layers in S3. Since Gateway endpoints are non-transitive, they cannot be accessed over Transit Gateway from another VPC.
3
Verify that the ECS task execution role has permissions to pull container images from ECR, read the secret from Secrets Manager, and decrypt the secret using the customer managed KMS key.
Ensures the ECS agent running on Fargate has the necessary credentials and IAM authorization to pull the container image and retrieve the secret during task initialization.
The ECS task execution role (not the task role) is responsible for these initialization actions.

Key Concept

Private ECS Fargate deployment requiring cross-account ECR, Secrets Manager, and S3 Gateway endpoint transit limits.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic