Examkin

Question

Difficulty: Very hardModernizing Workloads using Containers (ECS and EKS)

ApexMedia is migrating its high-throughput video processing orchestration system from an on-premises data center to AWS. The target architecture will use Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. Containers running in the Production and Development accounts must pull images from a centralized Amazon Elastic Container Registry (ECR) repository located in a Shared Services account. To comply with strict security standards, tasks must run in private subnets with no internet access (no NAT Gateways). The container images and secrets are encrypted using a Customer Managed Key (CMK) in AWS KMS in the Shared Services account. A Transit Gateway connects the Production, Development, and Shared Services VPCs. The Solutions Architect must configure cross-account access, networking, and DNS resolution to ensure Fargate tasks can pull images and decrypt required secrets from AWS Secrets Manager (which is also encrypted with the same KMS CMK in the Shared Services account).

Which combination of actions must the Solutions Architect perform to successfully deploy the containers? (Select TWO.)

  1. In the Shared Services account, update the ECR repository policy and the Secrets Manager resource policy to grant read access to the ECS Task Execution Roles of the Production and Development accounts. Update the key policy of the KMS Customer Managed Key in the Shared Services account to grant kms:Decrypt and kms:DescribeKey permissions to these execution roles.Answer
  2. Configure the ECS task definitions to use the awsvpc network mode. In both the Production and Development VPCs, deploy interface VPC endpoints with Private DNS enabled for ECR (ecr.api and ecr.dkr), Secrets Manager, and KMS, and create a gateway VPC endpoint for Amazon S3 associated with the subnet route tables.Answer
  3. C
    Configure the ECS task definitions to use the bridge network mode to leverage Docker port mapping. In both the Production and Development VPCs, deploy interface VPC endpoints with Private DNS enabled for ECR and Secrets Manager, and route all S3 layer download traffic through a single NAT Gateway located in the Shared Services VPC.
  4. D
    Configure the ECR repository and Secrets Manager to use the default AWS-managed KMS keys (aws/ecr and aws/secretsmanager) for encryption, and update the default key policies to allow cross-account access from the Production and Development ECS Task Execution Roles.
  5. E
    In the Shared Services VPC, deploy a gateway VPC endpoint for Amazon S3. Configure the Transit Gateway route tables to route all S3-bound traffic from the Production and Development VPC subnets to the Shared Services VPC to allow tasks to download image layers.

Answer

The correct actions are: updating the ECR repository policy, Secrets Manager resource policy, and KMS key policy in the Shared Services account to grant access to the consumer task execution roles; and configuring the ECS tasks to use the awsvpc network mode while deploying local interface VPC endpoints for ECR, Secrets Manager, and KMS alongside a local S3 gateway endpoint in both the Production and Development VPCs.
The correct architecture requires configuring the ECS task definitions to use the awsvpc network mode since Fargate does not support bridge mode. In VPCs without internet access, local interface VPC endpoints are required for ECR and Secrets Manager, and a local Gateway VPC endpoint is required for S3 because S3 Gateway endpoints do not support transitive routing over Transit Gateway. Additionally, cross-account access to ECR, Secrets Manager, and the Customer Managed Key (CMK) must be explicitly allowed by updating the ECR repository policy, Secrets Manager resource policy, and the KMS CMK key policy in the Shared Services account to trust the ECS Task Execution Roles of the consumer accounts.

Step-by-Step Solution

1
Select Fargate compatible network mode
ECS tasks must be configured to use the awsvpc network mode, which is the only network mode supported by AWS Fargate.
Fargate does not support bridge or host network modes.
2
Establish local endpoints in consumer VPCs
Create interface VPC endpoints (ECR API, ECR DKR, Secrets Manager, KMS) and a gateway VPC endpoint for S3 in the Production and Development VPCs.
Since tasks run in private subnets with no internet routes, local endpoints are required for service communication. Gateway endpoints cannot be routed transitively over Transit Gateway, necessitating local S3 gateway endpoints for image layer retrieval.
3
Configure cross-account resource access policies
Add policies on the ECR repository and Secrets Manager in the Shared Services account permitting read/get access to the task execution roles in the Production and Development accounts.
Resource-based policies are required to authorize cross-account API calls to pull images and read secrets.
4
Grant decryption rights on the Customer Managed Key (CMK)
Modify the KMS key policy of the CMK in the Shared Services account to allow the ECS Task Execution Roles in the Prod/Dev accounts to perform kms:Decrypt and kms:DescribeKey actions.
Because AWS-managed keys cannot be accessed cross-account, a Customer Managed Key must be used, and its key policy must explicitly authorize cross-account decryption operations.

Key Concept

Deploying containerized workloads on AWS Fargate in highly secure, isolated multi-account environments requires using the awsvpc network mode, configuring local interface and gateway VPC endpoints to avoid internet routing, and utilizing cross-account resource policies alongside KMS Customer Managed Key policies to delegate decryption rights.
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic