Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

An enterprise logistics company, GlobalTrack, is modernizing its legacy package tracking application by migrating it to AWS. The application will run as containerized microservices on AWS Fargate across multiple AWS accounts in an AWS Organization. The architecture consists of a Shared Services VPC in a central account and several Application VPCs in separate application accounts. To minimize costs and simplify administration, the enterprise wants to host the Amazon Elastic Container Registry (Amazon ECR) repositories and the Route 53 Private Hosted Zones centrally in the Shared Services VPC. The Fargate tasks in the Application VPCs must pull container images from the central ECR repositories and resolve ECR DNS names privately, without traversing the public internet. The Application VPCs are connected to the Shared Services VPC via an AWS Transit Gateway.

Which of the following actions should the Solutions Architect take to implement this architecture? (Select TWO.)

  1. Associate the Route 53 Private Hosted Zones for ECR created in the central Shared Services account with the Application VPCs in the application accounts.Answer
  2. Create an Amazon S3 VPC Gateway Endpoint in each Application VPC to allow the AWS Fargate tasks to download image layers directly.Answer
  3. C
    Configure the ECS Task Definitions in the Application VPCs to use the bridge network mode to map container ports and route image pull traffic.
  4. D
    Configure the Transit Gateway to route S3 traffic transitively to the S3 Gateway Endpoint located in the Shared Services VPC.
  5. E
    Configure the DNS resolver (169.254.169.253) in the Application VPCs to forward all ECR queries transitively to the Shared Services VPC resolver over the Transit Gateway.

Answer

To configure the multi-account AWS Fargate and ECR architecture, the Route 53 Private Hosted Zones for ECR must be associated with the Application VPCs, and an Amazon S3 Gateway Endpoint must be created in each Application VPC.
To privately pull images from Amazon ECR in a shared services VPC, tasks running in application VPCs must resolve the ECR DNS endpoints to the interface VPC endpoints in the Shared Services VPC, which requires associating the central Private Hosted Zones with the application VPCs. Additionally, because ECR stores image layers in Amazon S3, and S3 Gateway Endpoints do not support transitive routing over Transit Gateway, an S3 Gateway Endpoint must be created in each application VPC to allow tasks to download image layers directly and privately.

Step-by-Step Solution

1
Identify the network dependencies for pulling ECR images privately.
ECR requires connection to ECR API/DKR endpoints and Amazon S3 where the container image layers are actually stored.
Understanding ECR architecture is critical to routing traffic correctly.
2
Determine private DNS resolution requirements for cross-account VPCs.
The Route 53 Private Hosted Zones for the ECR endpoints in the Shared Services VPC must be associated with the Application VPCs.
This allows the application Fargate tasks to resolve the ECR endpoint domain names to the private IP addresses of the Shared Services VPC endpoints.
3
Configure Amazon S3 access for image layers.
Create an S3 Gateway Endpoint in each Application VPC.
Gateway endpoints cannot be accessed transitively over a Transit Gateway, so each Application VPC needs its own local S3 gateway endpoint to download ECR image layers.

Key Concept

Cross-account private container registry access and DNS resolution with AWS Fargate
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic