Examkin

Question

Difficulty: Very hardModernizing Workloads using Containers (ECS and EKS)

Veridian Credit Union is modernizing its high-frequency ledger processing microservice by migrating it from on-premises virtual machines to AWS. The microservice will be deployed on Amazon ECS using the AWS Fargate launch type. The tasks will reside in the Production VPC across three Availability Zones in private subnets with no internet access (no NAT Gateways). The container images must be pulled from a centralized Amazon ECR repository located in a Shared Services AWS account, where the images are encrypted using a KMS key. The application also retrieves database credentials from AWS Secrets Manager in the Production account. Additionally, the application must communicate with an on-premises core banking API via an AWS Direct Connect connection attached to an AWS Transit Gateway. All network traffic to AWS services must remain within the AWS private network. Which TWO configurations must the Solutions Architect implement to meet these requirements?

  1. Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, create VPC interface endpoints for ECR API, ECR Docker, and Secrets Manager, and a gateway VPC endpoint for Amazon S3.Answer
  2. In the Shared Services account, configure the ECR repository to use a Customer Managed Key (CMK) for encryption. Update the key policy of the CMK to grant kms:Decrypt and kms:DescribeKey permissions to the ECS task execution role in the Production account, and grant the role ECR read permissions in the repository policy.Answer
  3. C
    Configure the ECS task definition to use the bridge network mode to allow container-to-container port mapping. Create a single NAT Gateway in the Production VPC to route the image pull requests to the public ECR endpoints.
  4. D
    Configure the ECR repository in the Shared Services account to use the AWS-managed KMS key (aws/ecr) for image encryption. In the Production account, attach an IAM policy to the ECS task execution role granting kms:Decrypt permissions on the Shared Services account's aws/ecr key.
  5. E
    Create the ECR VPC interface endpoints in the Shared Services VPC. Associate the Route 53 Private Hosted Zone created for ECR in the Shared Services VPC with the Production VPC, and route all image pull traffic transitively from the Production VPC to the Shared Services VPC endpoints over the Transit Gateway.

Answer

Configure the ECS task definition to use the awsvpc network mode, create local VPC interface endpoints for ECR and Secrets Manager, and a gateway VPC endpoint for Amazon S3. In the Shared Services account, use a Customer Managed Key (CMK) to encrypt the ECR repository and grant cross-account KMS decryption and ECR read permissions to the Production account's ECS task execution role.
The correct options specify using the awsvpc network mode, which is mandatory for AWS Fargate, and setting up local VPC endpoints (including ECR API, ECR Docker, Secrets Manager, and the S3 Gateway endpoint) to allow private communication. They also correctly use a Customer Managed Key (CMK) in the Shared Services account with key policy modifications to grant decrypt permissions to the Production account's ECS task execution role, which is the only way to support cross-account image decryption.

Step-by-Step Solution

1
Select the appropriate network mode for AWS Fargate tasks.
The task definition must be configured to use the awsvpc network mode, as Fargate does not support bridge or host network modes.
AWS Fargate only supports the awsvpc network mode, where every task receives its own Elastic Network Interface (ENI).
2
Configure private AWS service connectivity for the Production VPC.
Interface VPC endpoints are created for ECR API, ECR Docker, and Secrets Manager, along with a gateway VPC endpoint for S3.
Since the VPC has no internet gateway or NAT gateways, private endpoints are required to interact with AWS services, and ECR requires S3 access to download container image layers.
3
Set up cross-account access and encryption for the ECR repository.
The ECR repository is configured to use a Customer Managed Key (CMK), and its key policy is updated to grant access to the Production account's ECS task execution role.
AWS managed keys cannot be shared across accounts. A Customer Managed Key is required to permit the task execution role in another account to decrypt the image layers during task launch.

Key Concept

Modernizing legacy workloads using Amazon ECS on AWS Fargate requires configuring the awsvpc network mode, establishing private VPC endpoints for service access without internet routing, and correctly delegating cross-account IAM and KMS permissions when using shared image registries.
Estimated Time:3m 0s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic