Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

A financial services firm, ApexLedger, is modernizing its transaction reconciliation application by migrating from on-premises virtual machines to AWS. The application consists of several containerized microservices that must run on a container orchestration platform. The backend reconciliation tasks require high CPU and memory resources that scale dynamically, and compliance mandates that each task must run in its own dedicated, isolated virtualization boundary with no sharing of the underlying host OS or resources with other tasks. The microservices must also communicate securely using internal DNS names across a multi-account network containing a Shared Services VPC and a Production VPC connected via AWS Transit Gateway. Finally, the application must decrypt sensitive transaction logs using a KMS key managed in a centralized Security account.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Configure the Amazon ECS task definitions to use the AWS Fargate launch type with the awsvpc network mode, register the services with AWS Cloud Map, and associate the resulting Route 53 Private Hosted Zone with both the Shared Services and Production VPCs.Answer
  2. In the centralized Security account, create a KMS Customer Managed Key (CMK) and update its key policy to grant the Amazon ECS task role in the Production account permissions to use the key for decryption.Answer
  3. C
    Configure the Amazon ECS task definitions to use the Amazon EC2 launch type with host networking mode to optimize container-to-container throughput and share the underlying host resources for cost efficiency.
  4. D
    Create an AWS Cloud Map namespace in the Shared Services VPC, and rely on AWS Transit Gateway transitive routing to resolve DNS queries from the Production VPC without associating the Route 53 Private Hosted Zone with the Production VPC.
  5. E
    In the centralized Security account, configure the AWS-managed KMS key (aws/kms) key policy to allow cross-account access, granting decryption permissions to the Amazon ECS task execution role in the Production account.

Answer

The correct actions are configuring the task definitions to use AWS Fargate with the awsvpc network mode, registering with AWS Cloud Map, associating the Route 53 Private Hosted Zone with both VPCs, and creating a KMS Customer Managed Key in the Security account with a key policy allowing the Production ECS task role cross-account access.
AWS Fargate provides hypervisor-level VM isolation for each ECS task, meeting compliance rules against host-level resource sharing. Fargate mandates the awsvpc network mode. The Private Hosted Zone created by Cloud Map in the Shared Services account must be explicitly associated with the Production VPC to allow DNS resolution. Finally, cross-account access to KMS requires a Customer Managed Key (CMK) since AWS-managed key policies cannot be modified, and permissions must be granted to the task role (which the application uses) rather than the task execution role (used by the ECS agent).

Step-by-Step Solution

1
Select the container launch type and networking mode based on compliance boundary constraints.
Choose AWS Fargate with the awsvpc network mode.
AWS Fargate runs tasks in dedicated kernel-isolated VM boundaries, fulfilling the requirement of zero host resource sharing. Fargate only supports the awsvpc network mode.
2
Establish cross-account, multi-VPC name resolution for internal service communication.
Configure AWS Cloud Map and associate the resulting Route 53 Private Hosted Zone with the Production VPC.
Private Hosted Zones must be explicitly associated with each VPC that needs to resolve the namespace, regardless of the Transit Gateway connectivity between those VPCs.
3
Implement secure cross-account decryption of sensitive data.
Create a Customer Managed Key (CMK) in the Security account and grant permissions to the ECS task role.
AWS-managed keys do not support policy modifications for cross-account access. The ECS task role represents the application container runtime identity, which performs the decryption.

Key Concept

Amazon ECS task networking, Fargate isolation, Route 53 Private Hosted Zone multi-VPC association, and cross-account AWS KMS key policies.
Estimated Time:3m 0s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic