Examkin

Question

Difficulty: Very hardVPC Security for Developers

A containerized microservice deployed on AWS Fargate inside a private VPC subnet needs to write transaction logs to an Amazon DynamoDB table and send real-time confirmation callbacks to an external payment processor at 198.51.100.50/32198.51.100.50/32. According to company security requirements, all database traffic must remain within the AWS network, and outbound traffic from the Fargate container must be restricted to only the payment processor and the DynamoDB service. Which TWO configurations must the developer implement to meet these requirements?

  1. Create a Gateway VPC Endpoint for DynamoDB, and associate it with the route table of the private subnet.Answer
  2. Configure the Fargate security group with outbound rules allowing HTTPS traffic on port 443443 to 198.51.100.50/32198.51.100.50/32 and to the AWS-managed prefix list representing DynamoDB.Answer
  3. C
    Deploy an AWS Lambda function inside the private subnet to proxy payment requests to the external API, and configure the Fargate tasks to invoke this function.
  4. D
    Modify the trust policy of the Fargate task execution role to allow the VPC's NAT Gateway to assume the role, enabling secure outbound internet routing.
  5. E
    Store the payment API credentials in Systems Manager Parameter Store with automatic rotation enabled, and configure the task definition to retrieve them.

Answer

Create a Gateway VPC Endpoint for DynamoDB associated with the private subnet's route table, and configure the Fargate security group with outbound rules allowing HTTPS traffic to the payment processor IP address and to the AWS-managed prefix list representing DynamoDB.
To secure DynamoDB traffic, a Gateway VPC Endpoint is created and associated with the private subnet's route table, which routes traffic to the service privately. To satisfy outbound restrictions, the Fargate task's security group is configured with egress rules allowing HTTPS traffic to the specific external payment processor IP address and to the AWS-managed prefix list representing DynamoDB.

Step-by-Step Solution

1
Create a Gateway VPC Endpoint for Amazon DynamoDB.
A gateway endpoint is provisioned in the VPC, associated with an AWS-managed prefix list representing DynamoDB.
Allows private connectivity to DynamoDB within the AWS network.
2
Associate the Gateway VPC Endpoint with the route table of the private subnet where Fargate runs.
The route table is updated with a route directing traffic for the DynamoDB prefix list to the Gateway VPC Endpoint.
Ensures that the private subnet's routing logic forwards database-bound requests directly to the endpoint.
3
Define outbound rules on the Fargate service security group.
An egress rule allows HTTPS (port 443443) traffic to destination 198.51.100.50/32198.51.100.50/32, and another egress rule allows traffic to the DynamoDB prefix list.
Enforces strict network boundaries, allowing outbound connections only to the payment processor and DynamoDB.

Key Concept

VPC Gateway Endpoints and security group prefix lists are used to route and restrict outbound traffic from private resources to specific AWS services and external targets.
Estimated Time:3m 0s
Rate this question

Topics

VPC Security for Developers

More questions from this topic