LogiTransit Global is modernizing a legacy order processing workload by migrating it to Amazon ECS on AWS Fargate. The ECS tasks will run in a private subnet within an application VPC that has no internet access. The application container images are stored in an Amazon Elastic Container Registry (ECR) repository located in a separate Shared Services AWS account. The container image layers in the ECR repository are encrypted using an AWS KMS Customer Managed Key (CMK) in the Shared Services account. Which configuration will allow the ECS Fargate tasks to pull the container images while adhering to the security principle of least privilege and minimizing data transfer costs?
- AConfigure the ECS task definition to use the bridge network mode to allow dynamic port mapping. Create Interface VPC endpoints for the ECR API and ECR Docker registries in the application VPC. In the Shared Services VPC, configure a NAT Gateway to route container image layer downloads from S3 to the public internet. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account.
- BConfigure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints with Private DNS enabled for the ECR API and ECR Docker registries, and a Gateway VPC endpoint for Amazon S3. Encrypt the ECR repository layers using the default AWS-managed KMS key (aws/ecr). Update the default AWS-managed KMS key policy to delegate kms:Decrypt permissions to the ECS task execution role in the application account. Grant the task execution role permissions to pull from the ECR repository.
- Configure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints with Private DNS enabled for the ECR API and ECR Docker registries, and a Gateway VPC endpoint for Amazon S3. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account. Grant the task execution role permissions to pull from the ECR repository, and configure the ECR repository policy to trust the task execution role.Cevap
- DConfigure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints for the ECR API and ECR Docker registries, but disable Private DNS to avoid conflicts with the Shared Services account. Create a Route 53 Private Hosted Zone (PHZ) for ecr.us-east-1.amazonaws.com in the Shared Services account, but do not associate it with the application VPC. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account.
Cevap
Configure the ECS task definition to use the awsvpc network mode. In the application VPC, create Interface VPC endpoints with Private DNS enabled for the ECR API and ECR Docker registries, and a Gateway VPC endpoint for Amazon S3. Update the key policy of the Customer Managed Key in the Shared Services account to allow kms:Decrypt permissions for the ECS task execution role ARN from the application account. Grant the task execution role permissions to pull from the ECR repository, and configure the ECR repository policy to trust the task execution role.
The correct configuration uses the awsvpc network mode (mandatory for Fargate) and establishes private connectivity via Interface endpoints for ECR and a Gateway endpoint for S3 (essential for downloading the image layers at no extra data processing cost). It also utilizes a Customer Managed Key (CMK) in the Shared Services account and updates its policy, since default AWS-managed keys cannot be shared cross-account.
Adım Adım Çözüm
Anahtar Kavram
Cross-account Amazon ECR pull from private ECS Fargate tasks using VPC endpoints and KMS Customer Managed Keys.