Exams / SAP-C03 / Study guide / Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR)
Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR): SAP-C03 study notes and practice questions
What to know about Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR) for the SAP-C03 exam, from the Architecture Design and Implementation Built for the Cloud domain (25% of the exam guide), then 1 free question to test it. Part of the SAP-C03 study guide.
SAP-C03 asks you to choose an orchestrator and launch type, connect services securely across VPCs and accounts, keep images scanned and cleaned up, and scale pods, tasks, nodes and functions on the right signal.
ECS or EKS, EC2 or Fargate
ECS: AWS-native, simpler, deep integration with ALB, IAM task roles and Service Connect. Pick it when the team has no Kubernetes investment and wants the least operational overhead.
EKS: Kubernetes APIs, Helm, operators and portability. Pick it when the company already runs Kubernetes or needs its ecosystem. EKS Auto Mode lets AWS manage nodes, scaling and core add-ons.
Fargate: no instances to patch or scale, per-task isolation. EC2 when you need GPUs, specific instance types, daemon-heavy workloads or the lowest cost at steady high utilization.
Service-to-service communication
Option
Fits
ECS Service Connect
ECS services finding each other by name, with retries, timeouts and traffic metrics, using Cloud Map namespaces
Amazon VPC Lattice
Services across many VPCs and accounts, mixing ECS, EKS, Lambda and EC2, with auth policies (IAM, SigV4) and no VPC peering or overlapping-CIDR worries; share service networks with AWS RAM
Internal ALB per service
Simple setups inside one VPC
AWS App Mesh reached end of support on September 30, 2026; AWS points App Mesh users to Service Connect or VPC Lattice, so don’t choose it for new designs.
Container images with Amazon ECR
Basic scanning (on push) or enhanced scanning with Amazon Inspector, which scans continuously for OS and language-package vulnerabilities and rescans when new CVEs appear.
Lifecycle policies expire untagged or old images by count or age, cutting storage cost.
Tag immutability stops overwriting a tag in production; replication copies images across Regions and accounts; pull through cache mirrors public registries; repository policies grant cross-account pulls.
Scaling
Layer
Mechanism
Lambda
Reserved concurrency caps or guarantees a function’s share; provisioned concurrency removes cold starts (scale it with Application Auto Scaling)
ECS service
Service auto scaling (Application Auto Scaling) with target tracking on CPU, memory or ALB requests per target; capacity providers scale the EC2 instances
EKS pods
Horizontal Pod Autoscaler on CPU, memory or custom metrics
A car maker runs its connected-vehicle platform as about 40 microservices on Amazon EKS in a telematics account. A dealer-portal team in a separate account must call two of those services.
The platform team wants every call authorized by the caller's IAM identity rather than by network location, and the telematics services must not need code changes to enforce it. The two accounts use overlapping CIDR ranges, so the teams cannot route traffic between their VPCs by IP address.
Which solution meets these requirements with the LEAST operational overhead?
Choose one answer.
AA. Peer the telematics VPC with the dealer VPC, add routes between the subnets, and restrict each service with a security group that allows only the dealer account's address range.
BB. Install an open-source service mesh on the EKS cluster with a sidecar proxy in every pod, extend the mesh to the dealer account through an east-west gateway, and authorize each call with the mesh's mutual TLS service identities.
CC. Publish each service through a public Amazon API Gateway REST API, and give the dealer team API keys in a usage plan that controls how often they can call each service.
DD. Create a VPC Lattice service network with the two services, share it with the dealer account through AWS RAM, attach IAM auth policies that allow only the dealer portal's role, and have the portal sign requests with SigV4.
Show the answer and explanation
Answer: D
A. Wrong: VPC peering requires non-overlapping CIDR ranges, so the overlap blocks this design. Security groups also filter by network address and cannot check the caller's IAM identity.
B. Wrong: A mesh can authorize calls with mutual TLS identities, but those are mesh certificates rather than IAM identities. The platform team would also run the control plane and sidecars for 40 services and stretch the mesh across accounts, which goes against the low-overhead requirement.
C. Wrong: API keys identify a client application but are not IAM identities, and the traffic crosses the public internet. This design misses the identity-based authorization requirement.
D. Right: Correct. VPC Lattice connects services across VPCs and accounts without routing by IP address, so overlapping CIDR ranges do not matter. IAM auth policies check the signed caller identity on each request, so the telematics services need no code change and the platform team runs no mesh. Learn more: What is Amazon VPC Lattice? (opens in a new tab)
Explanation
The overlapping CIDR ranges rule out peering, and the IAM-identity requirement rules out security groups and API keys. VPC Lattice gives cross-account service connectivity with IAM auth policies and no mesh to run, which a self-managed mesh does not match on operational effort.
Want more on Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR)? The 5 full-length practice sets have 5 more Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR) questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →
Study Containers, service mesh, images and scaling (ECS, EKS, VPC Lattice, ECR)