Examkin

Soru

Zorluk: ZorModernizing Workloads using Containers (ECS and EKS)

NovusPay is modernizing its transaction processing engine by migrating it from on-premises virtual machines to Amazon ECS on AWS Fargate in a production AWS account. The container images will be stored in a centralized Amazon ECR repository located in a separate Shared Services AWS account. To comply with strict financial regulations, the ECS tasks must run in private subnets with no route to the internet, and all network traffic to download container images and decrypt keys must be routed privately within the AWS network. The ECR repository must be encrypted at rest, and the production ECS tasks must be able to pull images securely. Which combination of actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. In the production VPC, create Interface VPC Endpoints (AWS PrivateLink) for com.amazonaws.region.ecr.dkr, com.amazonaws.region.ecr.api, and com.amazonaws.region.kms with Private DNS enabled. Attach a security group to these endpoints that allows inbound HTTPS traffic on port 443 from the security group associated with the Fargate tasks.Cevap
  2. Configure the Shared Services ECR repository to use a Customer Managed Key (CMK) for encryption. Update the CMK key policy to grant the production account's ECS task execution role permissions for kms:Decrypt and kms:DescribeKey. In the ECS task definition, configure the network mode to awsvpc.Cevap
  3. C
    In the production VPC, create Interface VPC Endpoints for com.amazonaws.region.ecr.dkr, com.amazonaws.region.ecr.api, and com.amazonaws.region.kms. In the ECS task definition, configure the network mode to bridge to enable container port mapping and link the task container to the ECS host network.
  4. D
    Create a Route 53 Private Hosted Zone for ECR in the Shared Services account. Associate this hosted zone only with the Shared Services VPC, and configure a Transit Gateway static route from the production VPC to resolve ECR DNS queries via the Shared Services resolver.
  5. E
    Configure the Shared Services ECR repository to use the AWS-managed KMS key (aws/ecr) for encryption. Modify the key policy in the Shared Services account to grant the production account's ECS task execution role permissions for kms:Decrypt and kms:DescribeKey.

Cevap

Create Interface VPC Endpoints for ECR and KMS in the production VPC with Private DNS enabled, and configure the Shared Services ECR repository with a Customer Managed Key (CMK) that grants the production account's ECS task execution role access to decrypt the key, while using the awsvpc network mode in the task definition.
To support private cross-account image pulling on AWS Fargate without internet routing, the production VPC must have Interface VPC Endpoints (PrivateLink) configured for both ECR endpoints (api and dkr) and KMS, with private DNS enabled so the tasks resolve the endpoints locally. Additionally, Fargate tasks must use the awsvpc network mode. Because the ECR repository is in a separate account, it must be encrypted with a Customer Managed Key (CMK) rather than the default AWS-managed key, because the policy of an AWS-managed key cannot be altered to grant cross-account permissions to the production account's ECS task execution role.

Adım Adım Çözüm

1
Analyze Fargate network mode requirements.
Identify that AWS Fargate tasks exclusively use the awsvpc network mode, which rules out options using host or bridge network configurations.
Choosing the correct network mode is required for Fargate tasks to initialize and launch successfully.
2
Address private connection requirements to AWS services.
Create Interface VPC Endpoints (PrivateLink) for com.amazonaws.region.ecr.dkr, com.amazonaws.region.ecr.api, and com.amazonaws.region.kms in the production VPC.
Since the tasks run in private subnets with no internet route, image downloading and KMS calls must traverse AWS PrivateLink.
3
Resolve cross-account KMS key requirements for ECR.
Avoid using the default AWS-managed KMS key (aws/ecr) because it cannot be modified. Configure a Customer Managed Key (CMK) on the ECR repository and authorize the production account's ECS task execution role in its key policy.
Cross-account access to encrypted ECR images requires a CMK with a resource-based policy that explicitly grants access to the external account's role.

Anahtar Kavram

Configuring private cross-account image pulling for AWS Fargate using VPC interface endpoints and custom KMS key policies.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru