FinQuery is migrating its high-frequency transaction verification application from an on-p… — AWS Certified Solutions Architect - Professional

FinQuery is migrating its high-frequency transaction verification application from an on-premises data center to AWS. The application consists of containerized services that require low-latency communication and raw access to the host network interface. Additionally, the containers must modify specific namespaced kernel parameters, such as `net.core.somaxconn`, using sysctl configurations to handle high volumes of concurrent connections. The container images are stored in a centralized shared services AWS account (account $111122223333$ ) in an Amazon Elastic Container Registry (Amazon ECR) repository. This repository is encrypted using a Customer Managed Key (CMK) in AWS Key Management Service (AWS KMS). The containerized application will run in a separate production AWS account (account $444455556666$ ) inside a VPC that has no path to or from the internet. All container image download traffic must remain entirely within the AWS private network. Which combination of actions will meet these requirements? (Select TWO.)

Configure the Amazon ECS task definition to use the host network mode, and specify the required sysctl parameters in the systemControls parameter of the container definition. Launch the tasks on an Amazon ECS cluster using the Amazon EC2 launch type.Answer
B
Configure the Amazon ECS task definition to use the awsvpc network mode, and specify the required sysctl parameters in the systemControls parameter of the container definition. Launch the tasks on AWS Fargate.
In the shared services account, update the Amazon ECR repository policy to allow the IAM task execution role from the production account to pull images, and update the KMS key policy to grant decrypt permissions to the same role. In the production account's VPC, create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3.Answer
D
In the shared services account, encrypt the Amazon ECR repository using the AWS-managed KMS key (aws/ecr). In the production account, configure the ECS task execution role to assume a cross-account IAM role in the shared services account that has permissions to pull from the ECR repository.
E
In the production account's VPC, deploy a single NAT Gateway in a public subnet to route image pull traffic to the Amazon ECR service over the internet. Configure the route tables in the private subnets to send ECR traffic to the NAT Gateway.

Answer

Configure the task definition to use host networking on Amazon ECS EC2 launch type to satisfy host access and sysctl modifications, and update the shared ECR repository and KMS key policies while provisioning ECR and S3 VPC endpoints in the application VPC.

The transaction verification workload requires raw host network access and namespaced kernel adjustments, which mandates Amazon ECS using the EC2 launch type with host network mode. AWS Fargate's awsvpc limitation makes it unsuitable here. For the cross-account ECR access, permissions must be granted on both the repository policy and the Customer Managed KMS key policy to the ECS task execution role in the production account. Additionally, Interface VPC endpoints for ECR and a Gateway VPC endpoint for Amazon S3 are required to fetch ECR images privately without internet connectivity.

Step-by-Step Solution

Identify container configuration and networking requirements.

The application requires modifying specific kernel settings (sysctl) and raw access to the host network interface. Because AWS Fargate only supports the awsvpc network mode and restricts host-level settings, the workload must run on the Amazon ECS EC2 launch type with host networking.

This configuration satisfies the low-latency host networking and sysctl system controls requirement.

Determine cross-account access and encryption permissions.

To allow the production account to pull images from the shared services account, the ECR repository policy and the Customer Managed KMS key policy must be updated to grant decrypt and read access to the production account's ECS task execution IAM role.

AWS-managed KMS keys cannot be shared across accounts, meaning a Customer Managed Key is required for cross-account ECR encryption.

Ensure private VPC routing for container images.

Create interface VPC endpoints for ECR and a gateway VPC endpoint for S3 inside the production VPC.

Since the production VPC has no internet connection, traffic must route privately to the AWS services. An S3 endpoint is required because ECR stores its image layers in S3.

Key Concept

Designing secure, high-performance containerized workloads using Amazon ECS EC2 launch type with host networking and cross-account ECR/KMS private integrations.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic