Examkin

Question

Difficulty: MediumVPC Security for Developers

A developer is deploying a containerized API on AWS Fargate within a private subnet of a custom VPC. The API needs to read and write data to an Amazon Aurora PostgreSQL database located in a different private subnet within the same VPC. Additionally, the API must fetch sensitive API keys from AWS Secrets Manager. There is no route to the internet or any NAT Gateway configured in the VPC. Which set of configurations is required to establish these connections securely?

  1. Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager, configure its security group to allow inbound HTTPS traffic from the Fargate task, and configure the Aurora security group to allow inbound PostgreSQL traffic from the Fargate task's security group.Answer
  2. B
    Deploy a NAT Gateway in the Fargate task's private subnet, add a route in its route table pointing 0.0.0.0/0 to the NAT Gateway, and configure the Aurora security group to allow inbound traffic from the NAT Gateway's private IP address.
  3. C
    Modify the IAM trust policy of the ECS task execution role to trust secretsmanager.amazonaws.com and add a policy allowing secretsmanager:GetSecretValue, then configure the Aurora routing table to propagate routes from the Fargate subnet.
  4. D
    Migrate the API keys from AWS Secrets Manager to Systems Manager Parameter Store, as Parameter Store is natively accessible within private subnets without requiring VPC endpoints or NAT gateways, and open port 5432 on the Aurora subnet's Network Access Control List (NACL) for inbound and outbound traffic.

Answer

Create an interface VPC endpoint (AWS PrivateLink) for Secrets Manager, configure its security group to allow inbound HTTPS traffic from the Fargate task, and configure the Aurora security group to allow inbound PostgreSQL traffic from the Fargate task's security group.
The correct option establishes a private, secure path to Secrets Manager via AWS PrivateLink within the VPC, and allows the Fargate task to securely communicate with the Aurora database in another private subnet of the same VPC using security groups.

Step-by-Step Solution

1
Analyze destination endpoints.
Amazon Aurora PostgreSQL is hosted within the VPC, while AWS Secrets Manager is a public AWS service endpoint outside the VPC.
This determines which connections require VPC-native routing and which require external access or endpoints.
2
Configure the database connection.
The Aurora security group is modified to allow inbound traffic on port 5432 originating from the security group of the Fargate task.
Since both resources reside in different private subnets of the same VPC, local routing is automatic, and security groups are used to restrict access.
3
Configure access to AWS Secrets Manager without internet access.
An interface VPC endpoint (PrivateLink) for Secrets Manager is created in the VPC subnets, and its security group is set to allow inbound HTTPS traffic (port 443) from the Fargate task's security group.
Since there is no internet route or NAT Gateway, a VPC endpoint is required to establish private connectivity to Secrets Manager.

Key Concept

VPC Security Groups and Private VPC Endpoints
Estimated Time:2m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic