Examkin

Soru

Zorluk: OrtaVPC Network Security

An enterprise is migrating a containerized microservice backend to Amazon ECS on AWS Fargate. The Fargate tasks are launched in private subnets of a VPC and must securely download container images from Amazon Elastic Container Registry (ECR) without routing traffic over the public internet. The company security policy mandates that no internet gateway or NAT gateway should be configured in this VPC. Which combination of VPC network security components should the solutions architect implement to meet these requirements? (Select TWO.)

  1. Create interface VPC endpoints for ECR and attach a security group to them that allows inbound HTTPS traffic from the Fargate tasks' security group.Cevap
  2. Create a gateway VPC endpoint for Amazon S3 and associate it with the route tables of the private subnets containing the Fargate tasks.Cevap
  3. C
    Deploy a NAT Gateway in the private subnets and add a route pointing 0.0.0.0/00.0.0.0/0 to the NAT Gateway to route image download traffic.
  4. D
    Configure the Network ACLs of the private subnets to allow outbound traffic to 0.0.0.0/00.0.0.0/0 on port 443, and allow inbound ephemeral port traffic to ensure return traffic is not blocked.
  5. E
    Deploy AWS WAF in the private VPC subnets to inspect and authorize outbound HTTPS traffic directed to the ECR service endpoints.

Cevap

Create interface VPC endpoints for ECR with a security group allowing HTTPS traffic from the Fargate tasks, and create a gateway VPC endpoint for Amazon S3 associated with the private subnet route tables.
To pull container images from Amazon ECR without sending traffic over the internet or using a NAT gateway, the VPC must connect privately to the AWS services. Interface VPC endpoints must be created for ECR (both the API and Docker registry endpoints), and their security groups must permit inbound HTTPS (port 443) traffic from the Fargate tasks. Because ECR stores image layers in S3, a gateway VPC endpoint for Amazon S3 must also be created and associated with the private subnet route tables to enable private download of the image layers.

Adım Adım Çözüm

1
Determine the network path requirements for pulling container images privately.
Identify that ECS Fargate tasks need private access to the ECR API endpoints and the underlying S3 buckets where ECR stores its image layers.
Since the VPC is isolated (no NAT Gateway or Internet Gateway), all traffic to AWS services must remain inside the AWS private network.
2
Configure the ECR endpoints.
Establish interface VPC endpoints for ECR and attach a security group that permits HTTPS traffic from the container tasks.
Interface endpoints provide private IP addresses for the ECR registry and API, allowing secure communication via private DNS.
3
Configure the S3 endpoint for layer retrieval.
Create an S3 gateway VPC endpoint and attach it to the route tables of the Fargate subnets.
ECR layers are stored in S3. Without the S3 gateway endpoint, the Fargate tasks will fail to retrieve the image layers even if they can authenticate with ECR.

Anahtar Kavram

VPC Endpoints (Interface vs. Gateway) and Security Groups for private AWS service communication
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru