Examkin

Question

Difficulty: Very hardVPC Network Security

An enterprise is hosting a secure data processing application in an Amazon VPC with a CIDR block of 10.0.0.0/16. The EC2 instances are located in a private subnet (10.0.1.0/24) and must retrieve datasets from an Amazon S3 bucket in the same AWS Region. A solutions architect has created an Amazon S3 Gateway VPC Endpoint and associated it with the route table of the private subnet. The security group assigned to the EC2 instances allows outbound TCP port 443 to 0.0.0.0/0 and denies all inbound traffic. A custom Network ACL (NACL) is associated with the private subnet and contains only the following rules:

* Inbound Rule 100: Allow TCP port 443 from 0.0.0.0/0
* Inbound Rule 110: Allow TCP ports 1024-65535 from 0.0.0.0/0
* Outbound Rule 100: Allow TCP port 443 to 0.0.0.0/0
* Outbound Rule 110: Allow TCP ports 1024-65535 to 0.0.0.0/0

During testing, the EC2 instances are unable to connect to the S3 bucket. Which of the following configuration omissions is preventing the EC2 instances from successfully accessing the Amazon S3 bucket?

  1. The custom Network ACL does not permit outbound UDP traffic on port 53 to the Route 53 Resolver (Amazon Provided DNS) at 10.0.0.2, blocking DNS resolution for the Amazon S3 endpoint.Answer
  2. B
    The security group associated with the EC2 instances lacks an inbound rule to permit return traffic on TCP ports 1024-65535 from the Amazon S3 prefix list.
  3. C
    The custom Network ACL lacks an inbound rule allowing TCP traffic on port 443 from AWS WAF to inspect the return packets from the S3 Gateway VPC Endpoint.
  4. D
    The security group associated with the Amazon S3 Gateway VPC Endpoint does not permit outbound TCP traffic on port 443 to the EC2 instances.

Answer

The custom Network ACL does not permit outbound UDP traffic on port 53 to the Route 53 Resolver (Amazon Provided DNS) at 10.0.0.2, blocking DNS resolution for the Amazon S3 endpoint.
Custom Network ACLs are stateless and deny all traffic that is not explicitly allowed. When an EC2 instance attempts to connect to Amazon S3, it must first resolve the S3 domain name via the Amazon Provided DNS (Route 53 Resolver) located at 10.0.0.2. Since the custom Network ACL rules only allow TCP port 443 and TCP ephemeral ports, the UDP port 53 DNS queries are dropped at the subnet boundary, preventing the instances from obtaining the IP address for the S3 service.

Step-by-Step Solution

1
Analyze the request flow from the EC2 instance to Amazon S3.
The EC2 instance must first resolve the S3 DNS hostname (e.g., s3.us-east-1.amazonaws.com) to an IP address before it can initiate an HTTPS session over port 443.
DNS resolution is a prerequisite for establishing an HTTPS connection to the S3 bucket.
2
Identify the target and protocol for DNS resolution within the VPC.
The instance sends a DNS query (typically UDP port 53) to the Route 53 Resolver (Amazon Provided DNS), which resides at the reserved IP address 10.0.0.2 (VPC network range plus two).
By default, instances in a VPC use the Amazon Provided DNS server for name resolution.
3
Evaluate the custom Network ACL rules for the private subnet.
The custom Network ACL only allows TCP port 443 and TCP ports 1024-65535. Outbound UDP port 53 traffic to 10.0.0.2 is blocked because custom Network ACLs are stateless and deny all traffic not explicitly allowed.
Because Network ACLs are stateless, both the outbound request and the inbound return traffic must be permitted explicitly.
4
Formulate the correction needed to allow DNS resolution.
Add an outbound Network ACL rule to allow UDP port 53 traffic to the Route 53 Resolver, and ensure inbound rules allow the return UDP traffic on ephemeral ports.
This allows the DNS resolution packets to cross the subnet boundary successfully.

Key Concept

Stateless Network ACLs and VPC DNS Resolution
Rate this question

Topics

VPC Network Security

More questions from this topic