DOP-C02 · Question #478
A company uses Amazon Elastic Container Registry (Amazon ECR) for all images of the company's containerized infrastructure. The company uses the pull through cache functionality with the /external…
The correct answer is B. Configure an ECR repository creation template for the prefix. Specify the KMS key. Wait for the. To enforce KMS encryption for new ECR pull-through cache repositories, configure the ECR pull-through cache rule for the /external prefix to specify the required AWS KMS key.
Question
A company uses Amazon Elastic Container Registry (Amazon ECR) for all images of the company's containerized infrastructure. The company uses the pull through cache functionality with the /external prefix to avoid throttling when the company retrieves images from external image registries. The company uses AWS Organizations for its accounts. Every image in the registry must be encrypted with a specific, pre-provisioned AWS Key Management Service (AWS KMS) key. The company's internally created images already comply with this policy. However, cached external images use server-side encryption with Amazon S3 managed keys (SSE- S3). The company must remove the noncompliant cache repositories. The company must also implement a secure solution to ensure that all new pull through cache repositories are automatically encrypted with the required KMS key. Which solution will meet these requirements?
Options
- AConfigure AWS Config. Add a custom rule that uses Guard syntax. Write the rule to enable KMS
- BConfigure an ECR repository creation template for the prefix. Specify the KMS key. Wait for the
- CConfigure an SCP for all AWS accounts that requires all ECR repositories to be KMS encrypted.
- DCreate a new Amazon EventBridge rule that triggers on all "ECR Pull Through Cache Action"
How the community answered
(23 responses)- A4% (1)
- B74% (17)
- C4% (1)
- D17% (4)
Why each option
To enforce KMS encryption for new ECR pull-through cache repositories, configure the ECR pull-through cache rule for the `/external` prefix to specify the required AWS KMS key.
AWS Config is a reactive service that detects and reports non-compliance with desired configurations but cannot proactively enforce specific encryption settings during the creation of new ECR repositories.
Amazon ECR pull-through cache rules allow administrators to define specific encryption settings, including the use of a designated AWS KMS key, for all repositories created by that rule. By configuring the pull-through cache rule for the `/external` prefix with the specified KMS key, any new repositories created via this cache mechanism will automatically be encrypted using the required key, ensuring compliance from inception.
An SCP (Service Control Policy) can prevent the creation of ECR repositories that do not meet encryption requirements, but it does not automatically configure or enforce the use of a specific KMS key when a repository is created; it only acts as a guardrail.
An Amazon EventBridge rule that triggers on 'ECR Pull Through Cache Action' would be a reactive approach, allowing non-compliant repositories to be created first and then requiring a subsequent action for remediation, which doesn't proactively 'ensure' compliance at creation.
Concept tested: ECR pull-through cache encryption enforcement
Source: https://docs.aws.amazon.com/AmazonECR/latest/userguide/pull-through-cache.html
Topics
Community Discussion
No community discussion yet for this question.