Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

A fleet management company, ApexLogistics, is modernizing its on-premises vehicle telematics ingestion system by migrating it to AWS. The application consists of a series of stateless containerized services that process real-time GPS coordinates. The solutions architect decides to deploy the workload on Amazon ECS using the AWS Fargate launch type to minimize operational overhead. The containers must run in private subnets, communicate securely, and write the processed telemetry data to an Amazon DynamoDB table. All traffic between the containerized services and DynamoDB must remain entirely within the AWS internal network without using public IP addresses or traversing the internet. Which architecture should the solutions architect implement to satisfy these requirements?

  1. A
    Configure the ECS task definitions to use the bridge network mode, deploy the tasks across multiple private subnets, and create an interface VPC endpoint for DynamoDB.
  2. B
    Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks in a single private subnet associated with a single NAT Gateway in one Availability Zone, and route DynamoDB traffic through the NAT Gateway.
  3. Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks across multiple private subnets, and create a gateway VPC endpoint for DynamoDB in the VPC route tables.Answer
  4. D
    Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks across multiple private subnets in a primary VPC, and resolve the DynamoDB service endpoint using a Route 53 Private Hosted Zone created in a shared services VPC that is not associated with the primary VPC.

Answer

Configure the ECS task definitions to use the awsvpc network mode, deploy the tasks across multiple private subnets, and create a gateway VPC endpoint for DynamoDB in the VPC route tables.
The correct architecture uses the awsvpc network mode, which is the only supported networking mode for AWS Fargate. Deploying tasks across multiple private subnets in different Availability Zones ensures high availability. Utilizing a gateway VPC endpoint for Amazon DynamoDB satisfies the security requirement by keeping all traffic internal to the AWS network, avoiding the need for public IPs or NAT Gateways.

Step-by-Step Solution

1
Determine the networking capability and requirements of the container hosting platform.
Identify that AWS Fargate only supports the awsvpc network mode, which allocates a dedicated Elastic Network Interface (ENI) to each task.
This rules out host or bridge networking modes, which are incompatible with the Fargate launch type.
2
Design private routing to Amazon DynamoDB.
Create a gateway VPC endpoint for DynamoDB and associate it with the route tables of the private subnets.
A gateway VPC endpoint routes traffic to DynamoDB privately over the AWS network, bypassing the public internet and avoiding the need for public IP addresses or NAT gateways.
3
Ensure high availability and fault tolerance.
Deploy the tasks across multiple private subnets in different Availability Zones.
Distributing tasks across multiple Availability Zones prevents a single subnet or AZ outage from disrupting the ingestion system.

Key Concept

AWS Fargate networking requires the awsvpc network mode, and secure, private integration with AWS services like DynamoDB is best achieved using VPC endpoints.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic