Examkin

Soru

Zorluk: OrtaModernizing Workloads using Containers (ECS and EKS)

A maritime freight analytics platform, VesselWave, is modernizing its containerized route-optimization application by migrating it from an on-premises Docker Swarm cluster to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The application tasks will run in private subnets and must not have any direct access to or from the public internet. The container images are stored in a private Amazon Elastic Container Registry (Amazon ECR) repository, and the application must write logs to Amazon CloudWatch. Which TWO configurations must the Solutions Architect implement to allow the Fargate tasks to securely pull images and write logs while adhering to these constraints?

  1. Create interface VPC endpoints for com.amazonaws.region.ecr.api and com.amazonaws.region.ecr.dkr in the VPC, and a gateway VPC endpoint for Amazon S3 associated with the private subnets' route tables.Cevap
  2. Configure the Amazon ECS task definition to use the awsvpc network mode, and assign an ECS task execution IAM role that grants permissions to pull images from Amazon ECR and write logs to Amazon CloudWatch.Cevap
  3. C
    Configure the Amazon ECS task definition to use the bridge network mode, and deploy an Application Load Balancer to route traffic to the container hosts.
  4. D
    Deploy a single NAT Gateway in a public subnet, and configure the private subnets' route tables to route all outbound 0.0.0.0/0 traffic to the NAT Gateway.
  5. E
    Create a custom Route 53 Private Hosted Zone for ECR endpoints and manually associate it with the VPC while disabling DNS hostnames and DNS resolution features.

Cevap

The correct configurations are to create interface VPC endpoints for ECR and a gateway VPC endpoint for S3, and to configure the task definition with the awsvpc network mode alongside an appropriate ECS task execution IAM role.
To run Amazon ECS tasks on AWS Fargate within private subnets without public internet routing, the tasks must use the awsvpc network mode. The ECS agent needs to pull images from Amazon ECR and send logs to CloudWatch. Because there is no internet route, AWS PrivateLink interface VPC endpoints for ECR (both ecr.api and ecr.dkr) must be created in the VPC. Additionally, because ECR stores its image layers in Amazon S3, a gateway VPC endpoint for S3 is required to allow tasks to download the layers. Finally, the ECS task execution IAM role must have the necessary policy permissions to authenticate with ECR, pull the image, and write to CloudWatch log streams.

Adım Adım Çözüm

1
Configure the network access for ECR and S3 in the isolated VPC.
Interface VPC endpoints for ECR (ecr.api and ecr.dkr) are created, and an Amazon S3 gateway VPC endpoint is attached to the route tables.
Because the tasks lack internet routes, they must connect to ECR via PrivateLink. Since ECR stores image layers in S3, a route to S3 is also required.
2
Configure the network mode in the task definition.
The network mode is set to awsvpc.
AWS Fargate only supports the awsvpc network mode, which assigns a dedicated Elastic Network Interface (ENI) to each task.
3
Configure the required IAM execution permissions.
The ECS task execution IAM role is assigned permissions to pull from ECR and write to CloudWatch Logs.
The ECS container agent requires these permissions during task initialization before the actual application container starts.

Anahtar Kavram

Configuring secure private network connectivity and execution roles for Amazon ECS tasks running on AWS Fargate in isolated subnets.
Tahmini Süre:2m 0s
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru