Examkin

Soru

Zorluk: OrtaModernizing Workloads using Containers (ECS and EKS)

PaySync Services is modernizing its mission-critical transaction-settlement application by migrating it from an on-premises virtualized environment to Amazon EKS. The application consists of stateless billing pods that process cardholder data and must pull container images from a centralized Amazon ECR repository located in a shared services AWS account. To comply with security policies, the billing pods must run on serverless compute, and the containers must not share hosts or network namespaces with other workloads. The billing pods require access to an Amazon Aurora PostgreSQL database located in an isolated database VPC, and they must retrieve database credentials securely from AWS Secrets Manager without using hardcoded keys.

Which combination of actions should the Solutions Architect perform to meet these requirements with the least operational overhead? (Select TWO.)

  1. Create an Amazon EKS Fargate profile for the namespace containing the billing pods. Configure the Amazon ECR repository policy in the shared services account to grant pull permissions to the EKS Fargate pod execution role in the application account.Cevap
  2. Create an IAM OIDC provider for the Amazon EKS cluster. Create an IAM role with a trust policy that allows the EKS service account in the billing namespace to assume the role, annotate the Kubernetes ServiceAccount with the IAM role ARN, and configure the pods to use this ServiceAccount to access AWS Secrets Manager.Cevap
  3. C
    Configure a Route 53 Private Hosted Zone (PHZ) for the Secrets Manager endpoint in the database VPC, and configure the AWS Transit Gateway to route DNS traffic between the EKS VPC and the database VPC.
  4. D
    Configure the billing pods to use host networking mode in their pod specifications to bypass Fargate container network interfaces and directly communicate with the database VPC.
  5. E
    Attach the AmazonEC2ContainerRegistryReadOnly managed IAM policy to the EKS node instance role, and deploy the billing pods as a DaemonSet to ensure image pull capabilities are distributed across all Fargate nodes.

Cevap

Create an Amazon EKS Fargate profile and configure the shared Amazon ECR repository policy to allow image pulls from the Fargate execution role. In addition, configure IAM Roles for Service Accounts (IRSA) using an OIDC provider to allow the pods to securely retrieve database credentials from AWS Secrets Manager.
To modernize the workload with serverless compute on Amazon EKS, the architect must use AWS Fargate. Creating a Fargate profile defines which pods run on Fargate. The EKS service uses the Fargate pod execution role to pull container images from Amazon ECR. Since ECR is in a shared services account, the registry policy must allow access to this execution role. Furthermore, to access Secrets Manager securely at the pod level, IAM Roles for Service Accounts (IRSA) must be configured using an OIDC provider, mapping the pod's ServiceAccount to an IAM role with the correct permissions.

Adım Adım Çözüm

1
Determine the compute model and pod scheduling mechanism.
Identify that AWS Fargate satisfies the requirement for serverless compute and low administrative effort. Create an EKS Fargate profile to match the namespace of the billing pods.
Fargate profiles dictate which Kubernetes pods are scheduled on Fargate serverless infrastructure rather than EC2 nodes.
2
Configure secure cross-account image pulling from ECR.
Grant the EKS Fargate pod execution role access to the ECR repository policy in the shared services account.
For Fargate deployments, EKS uses the Fargate pod execution role to authenticate with ECR and pull container images before initialization, rather than the pod's IAM role.
3
Configure fine-grained pod-level access to AWS Secrets Manager.
Establish an IAM OIDC provider for the EKS cluster and associate the service account with an IAM role containing the Secrets Manager read policy.
IAM Roles for Service Accounts (IRSA) provides secure, least-privilege access for application containers running inside pods to read secrets without relying on node instance profiles.

Anahtar Kavram

Deploying serverless container workloads on Amazon EKS with Fargate requires understanding the separate roles of the Fargate Pod Execution Role (used by the EKS service for system operations like pulling images) and IAM Roles for Service Accounts (IRSA, used by the application code to access AWS services).
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru