Examkin

Question

Difficulty: HardModernizing Workloads using Containers (ECS and EKS)

VoltGrid Solutions is modernizing its on-premises telemetry ingestion engine by migrating it to AWS. The engine processes real-time smart grid data from public utility endpoints and saves temporary states. The company wants to run this engine on Amazon ECS using the AWS Fargate launch type across 33 Availability Zones for high availability. To satisfy strict security compliance standards, Fargate tasks must run in private subnets with no direct route to the internet, and no NAT Gateways may be used. The container images are hosted in a centralized shared services AWS account (111122223333111122223333) in an Amazon ECR repository, which is encrypted using a Customer Managed Key (CMK) in AWS KMS. Additionally, tasks require access to a shared Amazon EFS file system to store and read active session states. All network traffic to AWS services must traverse VPC endpoints to keep traffic within the AWS private network. Which TWO actions should a solutions architect take to configure this environment and meet the security and architectural requirements? (Select TWO.)

  1. Configure interface VPC endpoints in the application's VPC for Amazon ECS telemetry, ECS agent, ECS service, Amazon ECR API, Amazon ECR Docker Registry, AWS KMS, and Amazon EFS, along with a gateway VPC endpoint for Amazon S3. Update the shared ECR repository policy and the KMS CMK key policy in the shared services account to grant permissions to the ECS task execution role in the application VPC.Answer
  2. Configure the ECS task definition using the awsvpc network mode and define the EFS volume using an EFS access point. Assign an ECS task execution role with permissions to read from ECR and decrypt with the KMS CMK. Set the security group on the EFS mount targets to allow inbound NFS traffic on TCP port 20492049 from the security group associated with the ECS Fargate tasks.Answer
  3. C
    Configure the ECS task definition using the host network mode to map container ports directly to the underlying host network interface for optimal throughput. Use the default AWS-managed KMS key (aws/ecr) to encrypt the ECR repository, and delegate decryption permissions to the ECS task execution role via the service-linked role.
  4. D
    Configure a single NAT Gateway in the shared services VPC and route the application's outbound ECS and ECR traffic through an AWS Transit Gateway. Ensure the private subnet route tables point to the Transit Gateway for all outbound destinations.
  5. E
    Configure a Route 5353 Private Hosted Zone (PHZ) for the ECR and KMS service endpoints in the shared services account to override public DNS resolution. Do not associate this PHZ with the application's VPC, and rely on standard DNS forwarders in the application VPC to resolve AWS service hostnames.

Answer

To modernise the workload on ECS Fargate, the solutions architect must: 1) Deploy interface endpoints for ECS, ECR API, ECR Registry, KMS, and EFS, along with a gateway endpoint for S3 in the application's VPC, and configure the target cross-account policies. 2) Configure the task definition using the awsvpc network mode with EFS access points, and configure the EFS security groups to allow NFS traffic (TCP port 20492049) from the tasks.
The correct configuration requires establishing PrivateLink interface endpoints in the application VPC for ECS, ECR, KMS, and EFS, along with an S3 gateway endpoint (since ECR stores image layers in S3). It also requires using the awsvpc network mode for ECS Fargate tasks, defining EFS access points, updating the cross-account ECR and KMS policies, and authorizing NFS traffic on TCP port 20492049 between the ECS task security group and the EFS mount target security group.

Step-by-Step Solution

1
Configure VPC Endpoint Infrastructure
Create interface VPC endpoints (PrivateLink) for com.amazonaws.region.ecs, com.amazonaws.region.ecs-agent, com.amazonaws.region.ecs-telemetry, com.amazonaws.region.ecr.api, com.amazonaws.region.ecr.dkr, com.amazonaws.region.kms, and com.amazonaws.region.elasticfilesystem. Create a gateway endpoint for Amazon S3 in the application VPC.
Required to pull images, send logs, decrypt KMS keys, and mount EFS volumes without traversing the public internet or using a NAT Gateway.
2
Set up Cross-Account Policies
Attach a repository policy to the shared ECR repository allowing access from the application account. Update the KMS Customer Managed Key policy in the shared services account to allow the ECS task execution role in the application account to perform kms:Decrypt.
Allows the application account's ECS agent to pull ECR images and decrypt the key used to encrypt the images.
3
Configure Task Networking and Mount Security Groups
Set the task definition network mode to awsvpc. Configure the security group associated with the EFS mount targets to allow inbound NFS traffic on TCP port 20492049 from the security group of the ECS Fargate tasks.
Fargate requires awsvpc network mode, which provisions elastic network interfaces for tasks. Security groups must allow NFS communication between the tasks and EFS.

Key Concept

Deploying fully private ECS Fargate tasks with cross-account ECR, KMS, and EFS dependencies requires configuring awsvpc network mode, cross-account IAM and KMS policies, and dedicated interface and gateway VPC endpoints.
Estimated Time:3m 0s
Rate this question

Topics

Modernizing Workloads using Containers (ECS and EKS)

More questions from this topic