Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

Vertex Media Group is migrating a legacy media transcoding pipeline from VMware virtual machines to AWS. The solution must containerize the transcoding tasks and run them on Amazon ECS using the AWS Fargate launch type to minimize operational overhead. The container images will be stored in a centralized Shared Services AWS account's Amazon ECR repository, which is encrypted using an AWS KMS Customer Managed Key (CMK). The Application VPC where the ECS tasks will run has no internet access, and all communication must remain within the AWS private network. Which combination of actions should the Solutions Architect take to configure the networking and permissions for the ECS tasks? (Select TWO.)

  1. Configure the ECS task definition to use the awsvpc network mode, and deploy Interface VPC endpoints for Amazon ECR (ecr.api and ecr.dkr) and AWS KMS, along with a Gateway VPC endpoint for Amazon S3 in the Application VPC.Answer
  2. Grant the ECS task execution role in the Application account permissions to pull images from ECR and decrypt them using the KMS key. Configure the ECR repository policy and the KMS Customer Managed Key policy in the Shared Services account to allow access from the Application account.Answer
  3. C
    Configure the ECS task definition to use the bridge network mode to enable task communication, and deploy Interface VPC endpoints for Amazon ECR and AWS KMS in the Application VPC.
  4. D
    Configure the ECS task execution role to decrypt the image using the default AWS-managed KMS key (aws/ecr) in the Shared Services account, and configure cross-account access via the Application account's IAM policy.

Answer

Configure the ECS task definition to use the awsvpc network mode, deploy ECR and KMS Interface VPC endpoints, along with an S3 Gateway VPC endpoint, and grant the ECS task execution role cross-account permissions to pull from the ECR repository and decrypt using the Customer Managed Key (CMK) in the Shared Services account.
To support containerized tasks on AWS Fargate in a private VPC, the ECS task definition must use the awsvpc network mode. Since the VPC lacks internet access, the task must resolve and pull images via VPC endpoints. ECR requires Interface VPC endpoints (ecr.api and ecr.dkr) and a Gateway VPC endpoint for Amazon S3 (where ECR stores layers). Additionally, to pull images encrypted with a KMS CMK from a Shared Services account, the task execution role must be granted cross-account pull and decrypt permissions, and the ECR repository policy and KMS Customer Managed Key policy must explicitly allow cross-account access from the Application account. AWS-managed KMS keys cannot be shared cross-account, necessitating a Customer Managed Key.

Step-by-Step Solution

1
Select the correct networking configuration for the ECS tasks on AWS Fargate.
The ECS task definition is configured to use the awsvpc network mode.
AWS Fargate only supports the awsvpc network mode, which assigns each task its own Elastic Network Interface (ENI).
2
Set up private VPC endpoints in the Application VPC to pull images from ECR without internet access.
Interface VPC endpoints for Amazon ECR (ecr.api and ecr.dkr) and AWS KMS are deployed, and a Gateway VPC endpoint for Amazon S3 is created.
Since the Application VPC has no internet access, private endpoints are required to reach AWS services. ECR requires both the ECR APIs and S3 (where image layers are stored) to pull images.
3
Configure permissions for cross-account ECR repository and KMS key access.
The ECS task execution role in the Application account is granted access, and the ECR repository and Customer Managed Key (CMK) policies in the Shared Services account are updated to allow access from the Application account.
Cross-account access requires configuring permissions on both the IAM role pulling the image (identity-based policy) and the resources in the Shared Services account (resource-based policies).

Key Concept

Modernizing legacy workloads using Amazon ECS on AWS Fargate requires configuring private connectivity via VPC endpoints (ECR, S3, KMS) and configuring cross-account access utilizing IAM roles and resource-based policies for Customer Managed Keys (CMKs) and ECR repositories.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic