A parks department runs an ECS container platform in a shared city VPC alongside other applications and needs controlled egress plus tightly scoped service-to-service connectivity. Which networking approach best fits this multi-app VPC?
Select an answer to reveal the explanation.
Short Explanation
Containers in a shared city VPC still need seat belts: private subnets, security groups between services, and intentional egress. Opening every port with public IPs is how a parks app becomes everyone else's problem. ECS lives in the VPC—use the VPC controls.
Full Explanation
An ECS container platform for parks in a shared city VPC still needs private placement, service-scoped security groups, and intentional egress. Tasks should run in private subnets so they are not directly internet-addressable; task- or service-level security groups then allow-list only the east-west ports peer services truly need. Egress should exit through NAT Gateways, VPC endpoints, or an explicit proxy—not through wide-open public IP assignments on every task. That pattern lets parks containers coexist with other city apps without turning the shared VPC into an any-to-any free-for-all.
Assigning public IPs to every task and opening all security group ports maximizes reachability and blast radius, which is the opposite of controlled egress and scoped service connectivity. Disabling security groups on ENIs used by ECS is false: ECS tasks in awsvpc mode use ENIs that participate in VPC security controls, and turning those off removes the primary microsegmentation tool. Placing all city applications in the default VPC with the default security group’s allow-all posture sacrifices isolation for temporary convenience and is a classic anti-pattern on professional exams and in production.
Exam caveat: awsvpc networking means security groups matter for tasks; do not assume container networking bypasses VPC controls, and do not confuse “shared VPC” with “no segmentation.” Operational check: confirm tasks have no public IPs, verify security group rules reference peer service groups rather than 0.0.0.0/0 for east-west, test that unauthorized ports time out, and validate egress to S3/APIs via endpoints or NAT while direct internet probes from tasks fail if policy requires it.