Examkin

Question

Difficulty: EasyVPC Security for Developers

An application runs on an Amazon EC2 instance located within a private subnet of a Virtual Private Cloud (VPC). The application must access AWS Systems Manager Parameter Store to retrieve configuration parameters. The security policy dictates that this traffic must not traverse the public internet. Which VPC configuration should be implemented to satisfy this requirement?

  1. Create an interface VPC endpoint for Systems Manager within the VPC.Answer
  2. B
    Configure a NAT Gateway in a public subnet and route all internet-bound traffic from the private subnet through it.
  3. C
    Update the IAM role trust policy on the EC2 instance to trust the Systems Manager service principal.
  4. D
    Migrate the parameters to AWS Secrets Manager and enable automatic credential rotation.

Answer

Create an interface VPC endpoint for Systems Manager within the VPC.
Creating an interface VPC endpoint for Systems Manager within the VPC is the correct solution. Interface VPC endpoints use AWS PrivateLink, which places elastic network interfaces (ENIs) with private IP addresses in the subnets. Traffic to Systems Manager is routed privately within the AWS network, satisfying the requirement to avoid the public internet.

Step-by-Step Solution

1
Identify the environment and target service requirements.
An application on an EC2 instance in a private subnet needs to access AWS Systems Manager Parameter Store.
This establishes the source and destination for the network traffic.
2
Apply the security constraint regarding internet traversal.
The traffic must remain entirely within the AWS network and cannot route through the public internet.
This eliminates options that route traffic through internet gateways or NAT gateways to public service endpoints.
3
Select the VPC private connectivity option for AWS services.
An interface VPC endpoint (powered by AWS PrivateLink) is configured for Systems Manager, providing private IP addresses within the VPC.
Interface VPC endpoints allow private subnets to communicate with AWS services securely without using public endpoints.

Key Concept

AWS PrivateLink and Interface VPC Endpoints allow private resources inside a VPC to securely connect to supported AWS services without internet traversal.
Rate this question

Topics

VPC Security for Developers

More questions from this topic