An educational technology company, EduStream, is modernizing its on-premises video transcoding application by migrating the workload to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The transcoding tasks must run in private subnets, pull container images from a private Amazon Elastic Container Registry (Amazon ECR) repository, and communicate with each other using direct task-to-task IP routing. Which TWO configurations must a solutions architect implement to satisfy these requirements? (Select TWO.)
- Configure the Amazon ECS task definition to use the awsvpc network mode, which assigns a unique elastic network interface (ENI) to each Fargate task.Cevap
- Create interface VPC endpoints (AWS PrivateLink) for Amazon ECR and Amazon ECS in the VPC to allow secure, private communication from the private subnets.Cevap
- CConfigure the Amazon ECS task definition to use the bridge network mode to allow the containerized application to dynamically bind to host ports.
- DCreate a Route 53 private hosted zone for the Amazon ECR service endpoint and associate it with the on-premises DNS resolvers without linking it to the VPC.
- EDeploy a single NAT Gateway in a public subnet to route all outbound container registration and pulling traffic from multiple private subnets across different Availability Zones.
Cevap
The correct configurations are configuring the Amazon ECS task definition to use the awsvpc network mode and creating interface VPC endpoints for Amazon ECR and Amazon ECS in the VPC.
The correct configuration requires using the awsvpc network mode in the ECS task definition, as AWS Fargate does not support bridge or host network modes. Additionally, interface VPC endpoints must be established for Amazon ECR and Amazon ECS within the VPC to allow tasks in private subnets to pull images and register with the ECS service control plane without public internet access.
Adım Adım Çözüm
Anahtar Kavram
Amazon ECS on AWS Fargate networking modes and private connectivity using VPC endpoints