Examkin

Question

Difficulty: Very hardAuto Scaling and Elastic Load Balancing (ELB)

A solutions architect is troubleshooting a microservices application deployed on AWS. The application consists of a fleet of Amazon EC2 instances in an Auto Scaling group (ASG) residing in private subnets. The ASG is registered with a target group of an Application Load Balancer (ALB) located in public subnets. The application is configured to listen on TCP port 8443, and the target group is configured with a target port of 8443. The health check is set to use the `traffic-port` (TCP port 8443) with the path `/healthz`.

To secure the network traffic, the following configurations are applied:
1. The security group associated with the EC2 instances allows inbound TCP traffic on port 8443 from the security group of the ALB.
2. The custom Network ACL (NACL) for the private subnets allows inbound TCP traffic on port 8443 from the public subnet CIDR block.
3. The custom NACL for the private subnets allows outbound TCP traffic on port 8443 to the public subnet CIDR block.

The application is running correctly on the EC2 instances, and querying the `/healthz` endpoint locally on the instances returns a `200 OK` status. However, the ALB marks all instances in the target group as unhealthy, and the ASG is continuously terminating and replacing the instances.

Which of the following modifications is required to resolve this issue and allow the ALB to successfully perform health checks?

  1. Modify the private subnet outbound Network ACL (NACL) rule to allow outbound TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR block.Answer
  2. B
    Modify the security group associated with the EC2 instances to allow outbound TCP traffic on ephemeral ports (1024-65535) to the security group of the ALB.
  3. C
    Change the health check port in the ALB target group settings from 'traffic-port' to port 80, and ensure the application on the EC2 instances is configured to listen on port 80 for health checks.
  4. D
    Update the Route 53 latency routing policy to direct traffic to the private IP addresses of the EC2 instances instead of the ALB's DNS name, and enable health check evaluation.

Answer

Modify the private subnet outbound Network ACL (NACL) rule to allow outbound TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR block.
The Application Load Balancer (ALB) initiates connection requests using ephemeral ports (1024-65535) to the target port (8443) on the EC2 instances. Because Network ACLs (NACLs) are stateless, return traffic must be explicitly allowed. Allowing outbound TCP traffic on ephemeral ports (1024-65535) to the public subnet CIDR block allows the EC2 instances to respond to the ALB's requests. Since the return traffic's destination port is the ALB's ephemeral port, this outbound rule enables the ALB to receive the health check response and mark the instances as healthy.

Step-by-Step Solution

1
Analyze the load balancing and routing path between the Application Load Balancer (ALB) in the public subnet and the EC2 instances in the private subnet.
The path involves stateless Network ACLs (NACLs) at the subnet boundaries and stateful Security Groups at the instance boundary.
Understanding the stateful versus stateless nature of these filters is key to identifying why traffic might be blocked in one direction.
2
Determine how connections are established by the ALB to the targets.
The ALB initiates a TCP connection from an ephemeral source port (1024-65535) to the destination target port (8443) on the EC2 instances.
This establishes the source and destination ports for both the request and the response packets.
3
Examine the stateless custom Network ACL (NACL) rules applied to the private subnets.
The inbound rule allows TCP traffic on destination port 8443, which lets the ALB's health check request reach the instances. However, the outbound rule only allows traffic with a destination port of 8443.
Because NACLs are stateless, return traffic is not tracked. The response packet from the EC2 instance is sent from source port 8443 back to the ALB's ephemeral destination port. Because the outbound NACL does not allow outbound traffic to ephemeral ports (1024-65535), the response is dropped.
4
Identify the required rule modification to permit the return traffic.
Add an outbound NACL rule for the private subnets allowing TCP traffic on destination ports 1024-65535 to the public subnet CIDR block.
This permits the return TCP packets to reach the ALB, completing the health check handshake.

Key Concept

Stateless Network ACLs require explicit outbound rules for return traffic using ephemeral client ports, unlike stateful security groups which track connection states automatically.
Estimated Time:3m 0s
Rate this question

Topics

Auto Scaling and Elastic Load Balancing (ELB)

More questions from this topic