Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring Amazon EC2 instances in a private subnet with no internet access to retrieve container images from Amazon Elastic Container Registry (Amazon ECR). The administrator creates Interface Endpoints for com.amazonaws.us-east-1.ecr.dkr and com.amazonaws.us-east-1.ecr.api in the VPC and enables private DNS. However, the instances still fail to pull container images, and the pull process times out when trying to download the image layers. Which action should the SysOps Administrator take to resolve this issue?

  1. A
    Add a route to the private subnet's route table targeting the elastic network interfaces of the ECR Interface Endpoints.
  2. B
    Create a Gateway Endpoint for Amazon S3, but do not select the private subnet's route table during the creation process.
  3. Create a Gateway Endpoint for Amazon S3 and associate it with the route table of the private subnet.Answer
  4. D
    Disable Private DNS hostnames on the ECR Interface Endpoints and associate a new security group that allows inbound HTTPS traffic from Amazon S3.

Answer

Create a Gateway Endpoint for Amazon S3 and associate it with the route table of the private subnet.
The correct answer is to create a Gateway Endpoint for Amazon S3 and associate it with the route table of the private subnet. Although Amazon ECR API commands and image manifests are accessed via ECR Interface Endpoints, the actual image layers are stored in Amazon S3. In a completely private subnet, the instances need private access to both ECR and S3. Creating and properly associating the S3 Gateway Endpoint ensures the instances can download the image layers.

Step-by-Step Solution

1
Identify the destination that is causing the timeout during the container image pull process.
Amazon ECR uses Amazon S3 under the hood to store and serve the actual image layers.
Understanding where the layer data is hosted helps target the correct endpoint configuration.
2
Establish private connectivity to Amazon S3 within the isolated VPC.
Create a Gateway Endpoint for Amazon S3.
A Gateway Endpoint provides direct, private connectivity to S3 without requiring an internet gateway or NAT gateway.
3
Associate the newly created Amazon S3 Gateway Endpoint with the route table of the private subnet containing the EC2 instances.
A route is automatically added to the route table directing S3-destined traffic through the Gateway Endpoint.
Without this association, the instances' traffic destined for S3 will not be routed to the endpoint, resulting in continued timeouts.

Key Concept

VPC Endpoints and PrivateLink Integration
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic