Solas Energy is modernizing its on-premises grid monitoring application by migrating it to AWS. The application consists of a Java-based API and a worker service that processes telemetry data. The target state requires hosting the containers on Amazon ECS with AWS Fargate for serverless operations. The API must be accessible only from a consumer VPC in a separate AWS account via a private connection. The worker service requires access to an Amazon DynamoDB table in the same account and must pull container images from a centralized Amazon ECR repository in a shared services account. The migration design must ensure high availability, use private endpoints, and avoid traversing the public internet.
Which combination of actions should the Solutions Architect implement to meet these requirements? (Select TWO.)
- Configure the ECS task definitions to use the awsvpc network mode, and deploy interface VPC endpoints for Amazon ECR and ECS, along with a gateway VPC endpoint for Amazon S3 in the application VPC.Cevap
- In the shared services account, configure the Amazon ECR repository policy to grant read access to the application account's ECS task execution role, and configure the Customer Managed Key (CMK) policy used for repository encryption to grant decryption permissions to the same role.Cevap
- CConfigure the ECS task definitions to use host networking mode to minimize container-to-container latency and map container ports directly to the underlying host interface on AWS Fargate.
- DEncrypt the Amazon ECR repository in the shared services account using the AWS-managed KMS key for ECR, and update the key policy to delegate cross-account decryption permissions to the task execution role.
- EConfigure the application VPC's private subnets to route traffic destined for Amazon ECR and Amazon DynamoDB through a single NAT Gateway deployed in a single public subnet to ensure secure outbound communication.