An enterprise logistics company, 'LogiGlobal', is modernizing its core package tracking system by migrating its on-premises microservices to AWS. The microservices must run on Amazon ECS with AWS Fargate to minimize compute management overhead. The tasks need to pull container images from a centralized Amazon Elastic Container Registry (ECR) repository located in a shared services AWS account. All network traffic between the Fargate tasks and the ECR repository must remain entirely within the AWS private network to satisfy security compliance. Additionally, the Fargate tasks must resolve the ECR endpoint using the default private DNS names. Which of the following configuration strategies should a Solutions Architect implement to meet these requirements with the least operational overhead?
- Deploy the tasks using the awsvpc network mode. Create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3 in the application VPC, enabling private DNS. Grant pull permissions to the application account's task execution IAM role in the shared services ECR repository policy.Cevap
- BDeploy the tasks using the bridge network mode to enable container port mapping. Create interface VPC endpoints for ECR and Amazon S3 in the application VPC, and configure the task execution role in the application account with ECR permissions.
- CDeploy the tasks using the awsvpc network mode. Create the interface VPC endpoints for ECR in the shared services VPC with Private DNS enabled. Create an AWS Transit Gateway to route traffic between the application VPC and the shared services VPC without associating the shared services private hosted zone with the application VPC.
- DDeploy the tasks using the awsvpc network mode. Create interface VPC endpoints for ECR and a gateway VPC endpoint for Amazon S3 in the application VPC. Encrypt the ECR repository using the AWS-managed KMS key (aws/ecr), and add the application task execution IAM role as a key user in the key policy.