A batch processing workload runs on Amazon ECS tasks using AWS Fargate. The tasks are dist… — AWS Certified SysOps Administrator - Associate

A batch processing workload runs on Amazon ECS tasks using AWS Fargate. The tasks are distributed across two private subnets in Availability Zones $us-west-2a$ and $us-west-2b$ within a single VPC. Every month, these tasks pull approximately $15\text{ TB}$ of container image layers from Amazon ECR and send $10\text{ TB}$ of log data to Amazon CloudWatch Logs. Currently, a single NAT Gateway located in $us-west-2a$ is used for all outbound traffic from both private subnets. The monthly AWS bill shows high costs for NAT Gateway data processing and cross-AZ data transfer.

Which two actions should a SysOps administrator take to minimize these data transfer costs while maintaining secure, private connectivity to ECR and CloudWatch Logs? (Select TWO.)

Create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables of the private subnets.Answer
Deploy Interface VPC Endpoints for ECR and CloudWatch Logs in both Availability Zones, and enable Private DNS.Answer
C
Provision a second NAT Gateway in the second Availability Zone and update the private route tables to route local AZ traffic through its respective NAT Gateway.
D
Create a Gateway VPC Endpoint for Amazon S3 but do not associate it with the private subnet route tables, relying on Private DNS for resolution.
E
Configure a single Interface VPC Endpoint for Amazon S3 in one of the Availability Zones to handle all S3 data retrieval.

Answer

To minimize data transfer costs, the SysOps administrator should create a Gateway VPC Endpoint for Amazon S3 and associate it with the private subnet route tables, and deploy Interface VPC Endpoints for ECR and CloudWatch Logs in both Availability Zones with Private DNS enabled.

The correct actions are to create a Gateway VPC Endpoint for Amazon S3 and associate it with the route tables, and deploy Interface VPC Endpoints for ECR and CloudWatch Logs in both Availability Zones. ECR stores container image layers in Amazon S3. By using a Gateway VPC Endpoint for S3, all layer downloads are routed privately and for free, bypassing the NAT Gateway. Deploying Interface VPC Endpoints for ECR and CloudWatch Logs in both Availability Zones ensures logs and ECR API calls are processed locally within each zone, replacing the

0.045 per GB NAT Gateway charge with the lower

0.01 per GB Interface Endpoint charge, and avoiding cross-AZ data transfer fees.

Step-by-Step Solution

Analyze the traffic destination and volume.

The ECS Fargate tasks pull

15\text{ TB}

of container image layers (stored in S3) from ECR and push

10\text{ TB}

of logs to CloudWatch Logs monthly.

Understanding the destinations allows selecting the correct endpoint type.

Evaluate NAT Gateway costs.

The current architecture routes all this traffic through a single NAT Gateway, incurring data processing fees of

0.045\text{ USD/GB}

for both pulling images and pushing logs, along with cross-AZ fees (

0.01\text{ USD/GB}

) for tasks in

us-west-2b

Identifying the current cost drivers helps determine the target areas for optimization.

Select the most cost-effective VPC endpoints.

S3 Gateway Endpoints are free and route S3 layer downloads. Interface VPC Endpoints for ECR and CloudWatch Logs charge

0.01\text{ USD/GB}

for data processing, which is significantly cheaper than NAT Gateway.

Replacing NAT Gateway routing with VPC endpoints minimizes data processing costs.

Address cross-AZ traffic.

By deploying the Interface Endpoints in both active Availability Zones and enabling Private DNS, Fargate tasks in each AZ connect to local endpoints, avoiding the

0.01\text{ USD/GB}

cross-AZ data transfer fee.

Local endpoints prevent traffic from crossing Availability Zone boundaries.

Key Concept

VPC Endpoint optimization and minimizing NAT Gateway data processing fees for AWS service traffic.

Estimated Time:2m 30s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic