Examkin

Question

Difficulty: MediumVPC Security for Developers

A developer is deploying an application on Amazon ECS (Fargate) tasks within a private subnet of a VPC. The application must retrieve database credentials from AWS Secrets Manager and publish events to an Amazon SNS topic. The company's security policy mandates that all traffic to AWS services must remain within the AWS network and must not traverse the public internet.

Which combination of configurations will meet these requirements? (Select TWO.)

  1. Create Interface VPC Endpoints (AWS PrivateLink) for Secrets Manager and SNS in the private subnets, and ensure private DNS hostnames are enabled for the VPC.Answer
  2. Configure the security groups associated with the VPC endpoints to allow inbound traffic on port 443 from the security group of the ECS tasks.Answer
  3. C
    Deploy a NAT Gateway in a public subnet, and configure the private subnet's route table to route traffic destined for Secrets Manager and SNS through the NAT Gateway.
  4. D
    Create Gateway VPC Endpoints for Secrets Manager and SNS, and add routes targeting these endpoints in the private subnet's route table.
  5. E
    Update the trust policy of the ECS task execution role to permit the VPC endpoint services to assume the role, granting them permission to route network traffic to the tasks.

Answer

The correct configurations are to create Interface VPC Endpoints for Secrets Manager and SNS with private DNS hostnames enabled, and to configure the security groups on the VPC endpoints to allow inbound traffic on port 443 from the ECS tasks' security group.
To connect ECS tasks in a private subnet securely to AWS services (Secrets Manager and SNS) without traversing the public internet, the developer must use Interface VPC Endpoints (AWS PrivateLink). Private DNS hostnames must be enabled so that standard SDK calls to these services resolve to the private endpoint interfaces. Additionally, because Interface VPC Endpoints use ENIs with security groups, the endpoint security groups must be configured to allow inbound traffic on port 443 (HTTPS) from the ECS tasks' security group.

Step-by-Step Solution

1
Determine the type of VPC endpoint required for Secrets Manager and SNS.
Both AWS Secrets Manager and Amazon SNS require Interface VPC Endpoints (AWS PrivateLink), as Gateway VPC Endpoints are only available for Amazon S3 and Amazon DynamoDB.
This establishes the basic network architecture needed to access these services without using a public internet path.
2
Configure private resolution for the service endpoints within the VPC.
Enable private DNS hostnames for the created Interface VPC Endpoints in the VPC settings.
This ensures that DNS queries for the service endpoints (e.g., secretsmanager.us-east-1.amazonaws.com) resolve to the private IP addresses of the endpoint ENIs rather than their public IPs, preventing application code modifications.
3
Configure network security rules (security groups) to permit communication.
Allow inbound traffic on port 443 in the VPC endpoint security groups originating from the ECS tasks' security group, and ensure the ECS tasks' security group allows outbound traffic to the endpoints on port 443.
Interface VPC Endpoints are stateful and use security groups to filter incoming traffic. Since they expose resources over HTTPS, traffic must be allowed on port 443.

Key Concept

Establishing secure, private connections from resources in a private VPC subnet to AWS services using AWS PrivateLink (Interface VPC Endpoints) and proper security group configurations.
Estimated Time:1m 30s
Rate this question

Topics

VPC Security for Developers

More questions from this topic