Chapter 10, Isolating Network Access

1. True.
2. You can use either the awsvpc (recommended) or host networking mode, which ensure your containers will obtain an IP address from the attached EC2 instance Elastic Network Interface (ENI).
3. False – the awsvpc network mode is required for ECS task networking.
4. You need to ensure the security groups configured for your ECS service permit access from the load-balancers.
5. You enable ECS task networking for an ECS task definition, however your containers fail on startup with an error that states they are unable to reach a location that is located on the internet. How can you resolve this issue?
6. Two – see https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-eni.html#AvailableIpPerENI.
7. One – a t2.micro supports a maximum of two ENIs, however, one ENI must be reserved for operating-system and ECS-agent communications.  Task-networking only allows a single task definition per ENI.
8. 10 – given you can have a maximum of 1 ECS task definition running in task-networking mode (see previous answer) and you can run up to 10 containers in a single ECS task definition (see https://docs.aws.amazon.com/AmazonECS/latest/developerguide/service_limits.html).
9. You must use the IP target type when using the awsvpc network mode.
10. You should remove the loadBalancers property from the ECS service definition.