Examkin

Soru

Zorluk: ZorModernizing Workloads using Containers (ECS and EKS)

A biotechnology research company, GeneSphere, is modernizing its legacy genomic analysis suite by migrating it from on-premises virtual machines to AWS. The company has containerized the workload and wants to deploy it using Amazon ECS with the AWS Fargate launch type for administrative simplicity.

The architecture comprises a multi-account AWS environment managed via AWS Organizations. The container images are stored in a centralized Amazon Elastic Container Registry (ECR) repository in a Shared Services account. The ECS tasks will be deployed in a separate Production account across three Availability Zones within a private subnet of the Production VPC.

For regulatory compliance, the deployment must meet the following requirements:
1. All traffic between the Fargate tasks and AWS services (Amazon ECR and Amazon S3) must remain private within the AWS network without traversing the public internet.
2. The Fargate tasks must resolve internal service endpoints (e.g., service.internal.local) hosted in the Shared Services VPC using a Route 53 Private Hosted Zone (PHZ) managed in the Shared Services account.
3. The network design must be highly available with no single point of failure.

Which configuration meets these requirements with the least operational overhead?

  1. Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, create Interface VPC endpoints for Amazon ECR (ecr.dkr and ecr.api) and a Gateway VPC endpoint for Amazon S3. In the Shared Services account, authorize the association of the Route 53 Private Hosted Zone with the Production VPC, and then associate it from the Production account. Configure the Production ECS task execution role and the Shared Services ECR repository policy to allow cross-account access.Cevap
  2. B
    Configure the ECS task definition to use the host network mode to optimize container networking performance. Create Interface VPC endpoints for Amazon ECR and a Gateway VPC endpoint for Amazon S3 in the Production VPC. In the Shared Services account, authorize the association of the Route 53 Private Hosted Zone with the Production VPC, and then associate it from the Production account. Configure the task execution role and ECR policy for cross-account access.
  3. C
    Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, create Interface VPC endpoints for Amazon ECR and a Gateway VPC endpoint for Amazon S3. Configure an AWS Transit Gateway between the Production VPC and the Shared Services VPC to automatically route DNS queries to the Shared Services Route 53 Private Hosted Zone without needing explicit hosted zone associations. Set up cross-account ECR permissions.
  4. D
    Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, deploy a single NAT Gateway in one Availability Zone to route all outbound ECR and S3 traffic through the public internet. Associate the Shared Services Route 53 Private Hosted Zone with the Production VPC using cross-account authorization. Configure the task execution role and ECR policy for cross-account access.

Cevap

Configure the ECS task definition to use the awsvpc network mode. In the Production VPC, create Interface VPC endpoints for Amazon ECR (ecr.dkr and ecr.api) and a Gateway VPC endpoint for Amazon S3. In the Shared Services account, authorize the association of the Route 53 Private Hosted Zone with the Production VPC, and then associate it from the Production account. Configure the Production ECS task execution role and the Shared Services ECR repository policy to allow cross-account access.
The correct configuration uses the awsvpc network mode, which is required for AWS Fargate tasks. By deploying Interface VPC endpoints for Amazon ECR (both dkr and api) and a Gateway VPC endpoint for Amazon S3 in the Production VPC, Fargate tasks can pull private container images completely within the private AWS network. Associating the Route 53 Private Hosted Zone from the Shared Services account with the Production VPC enables proper internal DNS resolution. Finally, granting cross-account permissions on the ECR repository policy and the Production task execution role allows the Production ECS tasks to pull images successfully.

Adım Adım Çözüm

1
Select the correct network mode for AWS Fargate tasks.
The awsvpc network mode is chosen, as it is the only network mode supported by Fargate.
AWS Fargate requires the task definition to use the awsvpc network mode to allocate an elastic network interface (ENI) to each task.
2
Configure private access to Amazon ECR and Amazon S3.
Interface VPC endpoints (ecr.dkr and ecr.api) and a Gateway VPC endpoint for Amazon S3 are deployed in the Production VPC.
To pull container images without traversing the public internet, Fargate tasks must use VPC endpoints. Since ECR image layers are stored in Amazon S3, a Gateway endpoint for S3 is also required to download layers privately.
3
Associate the cross-account Route 53 Private Hosted Zone.
An association authorization is created in the Shared Services account, and the association is accepted/completed in the Production account.
To resolve internal service domain names hosted in the Shared Services account from the Production VPC, the Private Hosted Zone must be associated with the Production VPC.
4
Establish cross-account ECR repository access.
The Production task execution role is granted ECR read permissions, and the Shared Services ECR repository policy is updated to trust the Production account ID.
IAM permissions must allow the Production ECS task agent to authenticate and pull image layers from the registry in the Shared Services account.

Anahtar Kavram

Cross-account Amazon ECS container modernization with private networking and DNS resolution
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru