Examkin

Soru

Zorluk: Çok zorModernizing Workloads using Containers (ECS and EKS)

Aetheris Health is modernizing its legacy patient data processing application by migrating it to Amazon ECS. The Solutions Architect must design a highly secure, containerized architecture that runs in private subnets with no internet gateway or NAT gateways. The application must pull container images from a central Amazon ECR registry located in a shared services AWS account, and read encrypted patient datasets from an Amazon S3 bucket in a separate storage AWS account. The data in the S3 bucket is encrypted using an AWS KMS Customer Managed Key (CMK) in the storage account. To optimize container-to-container communication, the development team has requested configuring the tasks to use the `bridge` network mode on AWS Fargate. Which architecture should the Solutions Architect recommend to meet these requirements with the lowest operational overhead?

  1. A
    Configure the ECS task definition to use the bridge network mode on AWS Fargate to enable dynamic port mapping. Create Interface VPC Endpoints in the application VPC for ECR and AWS KMS, and a Gateway VPC Endpoint for S3, with Private DNS enabled. Grant the ECS Task Execution Role ECR pull permissions, and configure the ECR repository policy to trust this role. Configure the ECS Task Role to read S3 and decrypt the data using the Customer Managed Key.
  2. B
    Configure the ECS task definition to use the awsvpc network mode on AWS Fargate. Create Interface VPC Endpoints in the application VPC for ECR (ecr.dkr and ecr.api) and AWS KMS, and a Gateway VPC Endpoint for S3, with Private DNS enabled. Grant the ECS Task Execution Role ECR pull permissions, and trust it in the ECR repository policy. Configure the ECS Task Role with permissions to read from the S3 bucket, encrypting and decrypting the bucket using the default AWS-managed KMS key (aws/s3) to simplify cross-account key management.
  3. Configure the ECS task definition to use the awsvpc network mode on AWS Fargate. Create Interface VPC Endpoints in the application VPC for ECR (ecr.dkr and ecr.api) and AWS KMS, and a Gateway VPC Endpoint for S3, with Private DNS enabled. Grant the ECS Task Execution Role permissions to pull ECR images, and configure the ECR repository policy in the shared services account to trust this role. Grant the ECS Task Role permissions to read S3 and decrypt KMS, and update the Customer Managed Key policy in the storage account to allow kms:Decrypt for the ECS Task Role.Cevap
  4. D
    Configure the ECS task definition to use the awsvpc network mode on AWS Fargate. Deploy an AWS Transit Gateway connected to a shared services VPC containing a single NAT Gateway to route ECR and S3 traffic. Create a Route 53 Private Hosted Zone for the ECR endpoints in the shared services account and manually associate it with the application VPC. Use the ECS Task Execution Role for both pulling images and decrypting the S3 objects using the Customer Managed Key.

Cevap

The correct design configures the ECS task definition to use the awsvpc network mode on AWS Fargate, establishes private communication using Interface VPC Endpoints for ECR and KMS, a Gateway VPC Endpoint for S3, grants ECR pull permissions to the Task Execution Role, and uses the ECS Task Role for cross-account S3 reads and KMS decryption via a Customer Managed Key.
The correct design uses AWS Fargate in awsvpc network mode, which is the only supported mode for Fargate. It establishes private communication via Interface VPC Endpoints for Amazon ECR and AWS KMS, and a Gateway VPC Endpoint for Amazon S3. By using a Customer Managed Key in the storage account and explicitly granting kms:Decrypt permissions to the ECS Task Role (which is used by the containerized application), and granting ECR pull permissions to the ECS Task Execution Role, all compliance and functional requirements are met with minimal operational overhead.

Adım Adım Çözüm

1
Determine the supported network mode for AWS Fargate tasks.
AWS Fargate only supports the `awsvpc` network mode, which assigns each task its own Elastic Network Interface (ENI). The requested `bridge` network mode must be rejected.
To ensure correct network configuration for the Fargate tasks.
2
Identify VPC endpoints required for private communication in a VPC with no NAT Gateway or Internet Gateway.
Create Interface VPC Endpoints for Amazon ECR (`ecr.dkr` and `ecr.api`) and AWS KMS, and a Gateway VPC Endpoint for Amazon S3, with Private DNS enabled.
To allow tasks to download images and interact with S3 and KMS without routing traffic over the public internet.
3
Configure ECS Task Execution Role vs Task Role permissions.
The Task Execution Role is configured to authorize container image pulls from ECR. The ECR repository policy in the shared services account must trust the Task Execution Role. The Task Role is configured to allow S3 access and KMS decryption.
To separate container lifecycle actions (Task Execution Role) from application runtime actions (Task Role).
4
Configure cross-account KMS decryption permissions.
Grant `kms:Decrypt` permission to the ECS Task Role in the Customer Managed Key (CMK) policy located in the storage account.
Cross-account decryption requires customer-managed keys because AWS-managed keys (like `aws/s3`) cannot be shared or modified.

Anahtar Kavram

Private VPC endpoint connectivity and cross-account IAM/KMS configurations for ECS Fargate tasks.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru