Examkin

Soru

Zorluk: Çok zorModernizing Workloads using Containers (ECS and EKS)

A healthcare SaaS provider is modernizing its on-premises, queue-driven DICOM image-processing application to AWS. The architecture must run on a serverless container platform to minimize operational overhead and automatically scale down to zero during periods of inactivity. Security and compliance requirements dictate that:

1. Each container task must have a dedicated private IP address and Elastic Network Interface (ENI) to allow granular security group configurations at the individual task level.
2. Ephemeral storage utilized by the container task to stage large medical images must be encrypted using a Customer Managed Key (CMK) in AWS KMS to satisfy HIPAA audit requirements.
3. The container tasks must resolve on-premises database hostnames via a Route 53 Private Hosted Zone (PHZ) hosted in a centralized shared services AWS account.
4. Outbound connectivity to the on-premises database must traverse an AWS Transit Gateway and must be resilient to Availability Zone failures without routing outbound public traffic through a single NAT Gateway.

Which of the following architectures meets these requirements while minimizing operational overhead?

  1. A
    Deploy the workload on Amazon ECS using AWS Fargate. Configure the ECS task definition to use bridge network mode to allow local container port mapping. Enable ephemeral storage encryption using the AWS-managed KMS key for Amazon ECS in the task definition. Associate the centralized Route 53 PHZ with the ECS VPC. Deploy NAT Gateways in each Availability Zone where tasks are running, and route all on-premises database traffic through the Transit Gateway.
  2. Deploy the workload on Amazon ECS using AWS Fargate (Platform Version 1.4.0 or later). Define the ECS tasks to use awsvpc network mode. Configure the ECS cluster setting to use a customer managed KMS key for Fargate ephemeral storage encryption. Associate the centralized Route 53 PHZ in the shared services account with the ECS VPC. Deploy a NAT Gateway in each Availability Zone containing the task subnets, and configure the local route tables to point on-premises traffic to the Transit Gateway attachment.Cevap
  3. C
    Deploy the workload on Amazon ECS using AWS Fargate with awsvpc network mode. Configure ephemeral storage encryption at the ECS cluster level using a customer managed KMS key. Rely on Transit Gateway routing to automatically propagate the Route 53 PHZ DNS resolution from the shared services VPC to the ECS VPC without explicit VPC association. Deploy a single NAT Gateway in a public subnet to handle all egress traffic.
  4. D
    Deploy the workload on Amazon ECS using AWS Fargate with awsvpc network mode. Configure the task definition's ephemeral storage settings to use the default AWS-managed KMS key and update its key policy to grant audit read access to the compliance team. Associate the centralized Route 53 PHZ with the ECS VPC. Deploy NAT Gateways in each Availability Zone where tasks are running and route traffic through the Transit Gateway.

Cevap

Deploying the workload on Amazon ECS using AWS Fargate with awsvpc network mode, utilizing the ECS cluster setting with a customer managed KMS key for ephemeral storage encryption, associating the centralized Route 53 Private Hosted Zone with the ECS VPC, and deploying redundant NAT Gateways across Availability Zones routing through the Transit Gateway.
Deploying the workload on Amazon ECS using AWS Fargate with the 'awsvpc' network mode satisfies the serverless execution model while guaranteeing dedicated ENIs and IPs for container-level security groups. Ephemeral storage encryption using a customer managed key configured at the cluster level ensures that HIPAA compliance audits can track key usage. Associating the centralized Route 53 PHZ with the ECS VPC enables on-premises hostname resolution. Configuring redundant NAT Gateways across Availability Zones and routing on-premises traffic through Transit Gateway satisfies the high availability and direct private connectivity constraints.

Adım Adım Çözüm

1
Evaluate the container network mode requirements.
Identify that AWS Fargate only supports the 'awsvpc' network mode, which allocates a dedicated ENI and private IP address per task. This fulfills the task-level security group and container isolation requirement.
Fargate abstracts the underlying host network space, making bridge and host networking modes invalid.
2
Determine the configuration for ephemeral storage encryption.
Specify the customer managed KMS key (CMK) at the ECS cluster level using the Fargate ephemeral storage encryption cluster settings (fargateEphemeralStorageKmsKeyId).
AWS-managed keys (like aws/ecs) have immutable key policies and cannot be customized with policy actions for audit logging, which is required for HIPAA compliance.
3
Design DNS resolution for the multi-account architecture.
Associate the Route 53 Private Hosted Zone (PHZ) created in the shared services account with the consumer ECS VPC.
DNS resolution of a PHZ does not transitively propagate across Transit Gateway VPC attachments without an explicit association of the hosted zone with the VPC.
4
Formulate highly available network routing.
Deploy NAT Gateways in each Availability Zone where tasks run to provide redundant egress paths, and update route tables to direct on-premises CIDR traffic to the Transit Gateway.
A single NAT Gateway creates a single point of failure, violating the resilience requirement in the event of an AZ outage.

Anahtar Kavram

Modernizing Workloads using Containers (ECS and EKS)
Bu soruyu puanla

Konular

Modernizing Workloads using Containers (ECS and EKS)

Bu konudan daha fazla soru