Examkin

Soru

Zorluk: ZorModernizing Workloads using Containers (ECS and EKS)

Vortex Logistics is modernizing its legacy fleet tracking and dispatch application by migrating it to AWS. The application consists of several microservices that will be deployed on Amazon ECS using the AWS Fargate launch type. The tasks must be distributed across three Availability Zones in private subnets. The microservices must download dynamic compliance lists from the public internet and resolve hostnames for an internal inventory service hosted in a shared-services AWS account via a Route 53 Private Hosted Zone (PHZ) named `inventory.internal`. All Fargate tasks must run in isolated network environments without public IP addresses to comply with strict security policies. Which combination of actions should the Solutions Architect take to meet these requirements? (Select TWO.)

  1. Configure the ECS task definition to use `awsvpc` network mode. When creating the ECS service, assign the tasks to the private subnets and set the `AssignPublicIp` parameter to `DISABLED` to prevent direct public internet access.Cevap
  2. Associate the Route 53 Private Hosted Zone `inventory.internal` from the shared-services account with the application VPC, and ensure that both `enableDnsHostnames` and `enableDnsSupport` are set to `true` on the application VPC.Cevap
  3. C
    Configure the ECS task definition to use `bridge` network mode to enable dynamic port mapping and allow the tasks to bind to the host network interface of the Fargate infrastructure.
  4. D
    Create a duplicate Private Hosted Zone `inventory.internal` in the application account and deploy Route 53 Resolver outbound endpoints in the application VPC to forward internal queries to a Resolver inbound endpoint in the shared-services VPC.
  5. E
    Deploy a single NAT Gateway in a single public subnet to optimize costs, and configure the route tables of all private subnets across the three Availability Zones to route outbound internet traffic (0.0.0.0/00.0.0.0/0) to this NAT Gateway.

Cevap

Configure the ECS task definition to use `awsvpc` network mode, run the tasks in the private subnets with `AssignPublicIp` disabled, and associate the shared-services Route 53 Private Hosted Zone with the application VPC while ensuring DNS support and hostnames are enabled.
AWS Fargate requires the `awsvpc` network mode. To run tasks in private subnets without public IP addresses, `AssignPublicIp` must be disabled, and outbound traffic must route through NAT Gateways. Cross-account Route 53 Private Hosted Zone association allows the VPC in the application account to resolve hostnames in the shared-services zone directly, provided that DNS hostnames and DNS support are enabled in the consumer VPC.

Adım Adım Çözüm

1
Select the correct network mode for ECS Fargate.
Confirm that the task definition uses `awsvpc` network mode, as AWS Fargate does not support bridge or host network modes.
AWS Fargate requires `awsvpc` mode where each task receives its own elastic network interface (ENI).
2
Ensure network isolation for private tasks.
Launch ECS Fargate tasks within private subnets with the `AssignPublicIp` configuration disabled.
This prevents Fargate from assigning public IP addresses, maintaining strict compliance and isolation.
3
Enable cross-account internal name resolution.
Associate the Route 53 Private Hosted Zone `inventory.internal` from the shared-services account with the application VPC.
Direct association allows resources in the application VPC to resolve hostnames within the shared private hosted zone.
4
Verify VPC DNS settings.
Enable `enableDnsSupport` and `enableDnsHostnames` attributes on the application VPC.
Route 53 Private Hosted Zone resolution depends on these VPC attributes being enabled.

Anahtar Kavram

AWS ECS Fargate networking rules and cross-account Route 53 Private Hosted Zone association.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru