Examkin

Question

Difficulty: MediumModernizing Workloads using Containers (ECS and EKS)

AeroParts Global is modernizing its on-premises inventory lookup application by migrating it to AWS. The architecture must run on Amazon ECS using the AWS Fargate launch type to reduce management overhead. The ECS tasks will be deployed in a new VPC (VPC A) and must securely access an internal database hosted in a separate VPC (VPC B) that is connected using an AWS Transit Gateway. The database hostnames are managed via an Amazon Route 53 Private Hosted Zone (PHZ) in the AWS account containing VPC B. Which of the following should a solutions architect configure to ensure that the ECS tasks can resolve the database hostname and establish network connectivity?

  1. A
    Deploy the ECS tasks using the bridge network mode to simplify container port mapping. Associate the Route 53 Private Hosted Zone in the database account with VPC A, and configure Transit Gateway routing to direct database traffic.
  2. B
    Deploy the ECS tasks using the awsvpc network mode. Rely on the Transit Gateway network transit path to automatically route DNS queries to the DNS servers of VPC B without associating the Private Hosted Zone with VPC A, and configure Transit Gateway routing.
  3. Deploy the ECS tasks using the awsvpc network mode. Associate the Route 53 Private Hosted Zone in the database account with VPC A, and update the route tables in VPC A to direct database traffic to the Transit Gateway.Answer
  4. D
    Deploy the ECS tasks using the awsvpc network mode. Provision a Direct Connect Gateway to establish transitive routing between VPC A and VPC B for database traffic, and associate the Route 53 Private Hosted Zone with VPC A.

Answer

Deploy the ECS tasks using the awsvpc network mode, associate the Route 53 Private Hosted Zone in the database account with VPC A, and update the route tables in VPC A to direct database traffic to the Transit Gateway.
To run containers on AWS Fargate, the tasks must be configured with the awsvpc network mode because Fargate does not support other modes. To enable DNS resolution of the private hosted zone in VPC A, the zone must be explicitly associated with VPC A. Finally, routing database-destined traffic through the Transit Gateway is required to establish network connectivity between VPC A and VPC B.

Step-by-Step Solution

1
Determine the required ECS network mode for Fargate tasks.
Identify that ECS tasks on Fargate must use the awsvpc network mode.
AWS Fargate does not support bridge or host networking modes; awsvpc is mandatory.
2
Determine the DNS resolution requirement for the Private Hosted Zone.
Identify that the Route 53 Private Hosted Zone from the database account must be associated with the application VPC (VPC A).
Private Hosted Zones cannot resolve across Transit Gateway peerings without direct association to the resolving VPC.
3
Configure network routing between the VPCs.
Add routes in the VPC A route tables pointing database-bound traffic to the Transit Gateway attachment.
The Transit Gateway acts as the router to pass traffic securely between VPC A and VPC B.

Key Concept

ECS Fargate Network Modes and Route 53 PHZ VPC Associations
Estimated Time:2m 0s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic