A company is modernizing its legacy on-premises web application by migrating the workload to Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type. The modernized architecture requires that containerized tasks run securely in private subnets and pull container images from Amazon Elastic Container Registry (Amazon ECR) without traversing the public internet.
Which TWO configurations should the solutions architect implement to satisfy these requirements?
- Configure the ECS task definitions to use the awsvpc network mode.Answer
- Create VPC endpoints for Amazon ECR to enable private image pull operations.Answer
- CConfigure the ECS task definitions to use the bridge network mode to optimize container-to-container port mapping.
- DDeploy a single NAT Gateway in a public subnet to route all ECR traffic securely over the public internet.
Answer
Configure the ECS task definitions to use the awsvpc network mode and create VPC endpoints for Amazon ECR to enable private image pull operations.
The correct configurations are to use the awsvpc network mode, which is the only supported network mode for tasks running on AWS Fargate, and to create VPC endpoints for Amazon ECR, which ensures that all image pulling traffic stays within the AWS network and does not traverse the public internet.
Step-by-Step Solution
Key Concept
AWS Fargate networking constraints and private access to AWS services via VPC endpoints