Examkin

Soru

Zorluk: ZorModernizing Workloads using Containers (ECS and EKS)

Astraea Genomics is modernizing its on-premises legacy genomic sequencing application by migrating it to AWS. The application will run as containerized tasks in a Production AWS account on Amazon ECS using AWS Fargate. To meet strict HIPAA and GDPR compliance standards, all data and container images must be encrypted at rest, and all traffic must remain within the private network. The modernization must satisfy the following constraints:
1. The container images must be pulled from an Amazon Elastic Container Registry (Amazon ECR) repository located in a Shared Services AWS account.
2. All traffic between the Production VPC and Amazon ECR must be routed entirely over the private AWS network, as the Production VPC has no internet access.
3. The container images are encrypted at rest using an AWS KMS key in the Shared Services account.
4. The network architecture must be highly available across three Availability Zones without introducing single points of failure.

Which combination of actions should a solutions architect take to configure this environment? (Select TWO.)

  1. In the Production VPC, create interface VPC endpoints for the ECR API and ECR Docker registry, and a gateway VPC endpoint for Amazon S3. Configure the ECS task definition to use the awsvpc network mode.Cevap
  2. In the Shared Services account, configure the ECR repository to use a Customer Managed Key (CMK). Update the key policy of the CMK to grant the ECS task execution IAM role in the Production account permissions for the kms:Decrypt and kms:DescribeKey actions.Cevap
  3. C
    In the Production VPC, deploy a single NAT Gateway in one Availability Zone to route ECR traffic, and configure the ECS task definition to use the bridge network mode.
  4. D
    In the Shared Services account, configure the ECR repository to use the AWS-managed KMS key (aws/ecr). Update the key policy of aws/ecr to grant the ECS task execution IAM role in the Production account permissions for the kms:Decrypt action.
  5. E
    Create a Route 53 Private Hosted Zone (PHZ) for the ECR DNS namespace in the Shared Services account, associate it with the Shared Services VPC, and route ECR traffic using a Direct Connect gateway without a Transit Gateway.

Cevap

The correct combination of actions is: creating ECR interface endpoints and an S3 gateway endpoint in the Production VPC with the task definition configured for the awsvpc network mode; and using a Customer Managed Key (CMK) in the Shared Services account with its key policy updated to grant decryption permissions to the Production account's ECS task execution role.
To achieve a secure, private, and highly available architecture, the Production VPC must have local interface endpoints for ECR and a gateway endpoint for S3 to pull image layers. Since tasks run on AWS Fargate, the task definition must use the awsvpc network mode. In addition, ECR cross-account image pull requires decrypting image layers encrypted with a KMS Customer Managed Key (CMK). AWS-managed keys cannot be shared cross-account, so a CMK is required in the Shared Services account with a key policy that explicitly delegates access to the Production account's ECS task execution role.

Adım Adım Çözüm

1
Determine the required VPC endpoints for private ECR communication.
Identify that ECR API and ECR Docker registry endpoints, alongside an Amazon S3 gateway endpoint (for image layers), must be created in the Production VPC.
Since the Production VPC has no internet access, interface VPC endpoints are required to privately access ECR. ECR stores image layers in Amazon S3, requiring a gateway VPC endpoint for S3.
2
Identify the correct network mode for AWS Fargate tasks on Amazon ECS.
Specify the awsvpc network mode in the task definition.
AWS Fargate does not support host or bridge network modes; the awsvpc network mode is mandatory.
3
Address ECR image decryption for cross-account setups.
Configure ECR to use a Customer Managed Key (CMK) in the Shared Services account and update the key policy to grant kms:Decrypt and kms:DescribeKey permissions to the Production account's task execution IAM role.
AWS-managed KMS keys (like aws/ecr) cannot be shared cross-account. A Customer Managed Key must be used to allow cross-account access.

Anahtar Kavram

Privately pulling ECR container images across accounts using ECS on AWS Fargate with Customer Managed Key encryption.
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru