Examkin

Question

Difficulty: MediumVPC Network Security

A solutions architect is designing the network security for a new application running on Amazon EC2 instances in private subnets. The application must download configuration objects from Amazon S3 and publish event messages to Amazon Simple Notification Service (Amazon SNS). The company’s security policy strictly prohibits the private subnets from having any routing to the public internet, including through NAT gateways. Which combination of steps should the solutions architect take to securely establish this connectivity? (Select TWO.)

  1. Create a gateway VPC endpoint for Amazon S3, and associate it with the route tables of the private subnets.Answer
  2. Create an interface VPC endpoint for Amazon SNS, and configure the security group of the SNS endpoint to allow inbound HTTPS traffic on TCP port 443443 from the EC2 instances' security group.Answer
  3. C
    Deploy a NAT gateway in a public subnet, and configure the route tables of the private subnets to route all Amazon S3 traffic through the NAT gateway.
  4. D
    Create a gateway VPC endpoint for Amazon SNS, and configure the private subnets' network ACL to allow outbound traffic to the endpoint on port 8080.
  5. E
    Create an interface VPC endpoint for Amazon S3, and configure the private subnets' network ACL to allow inbound and outbound traffic to the endpoint on port 8080 since network ACLs are stateful.

Answer

The correct steps are to create a gateway VPC endpoint for Amazon S3 and associate it with the private subnet route tables, and to create an interface VPC endpoint for Amazon SNS with its security group configured to allow inbound HTTPS traffic on TCP port 443443 from the EC2 instances.
To satisfy the security requirement of accessing Amazon S3 and Amazon SNS without internet routing (including NAT gateways), VPC endpoints must be used. For Amazon S3, a Gateway VPC endpoint is created and associated with the route tables of the private subnets. For Amazon SNS, an Interface VPC endpoint (AWS PrivateLink) is deployed, which assigns a private IP address within the subnet to the service. The interface endpoint is secured with a security group that must allow inbound HTTPS traffic on port 443443 from the EC2 instances.

Step-by-Step Solution

1
Identify the endpoint type required for Amazon S3.
Determine that Amazon S3 supports Gateway VPC endpoints, which are free of charge and integrate directly with route tables.
VPC Gateway endpoints are the standard, secure, and cost-effective way to access Amazon S3 from private subnets without public internet routing.
2
Identify the endpoint type required for Amazon SNS.
Determine that Amazon SNS only supports Interface VPC endpoints (AWS PrivateLink).
AWS PrivateLink exposes the service as an Elastic Network Interface (ENI) within the subnet with a private IP address.
3
Configure the security controls for the Interface endpoint.
Configure the security group attached to the Amazon SNS Interface endpoint to allow inbound traffic on TCP port 443443 (HTTPS) from the security group of the EC2 instances.
Interface endpoints use security groups for stateful access control, and communications to AWS APIs are conducted over HTTPS.

Key Concept

VPC Endpoints and Security Group Management
Estimated Time:2m 0s
Rate this question

Topics

VPC Network Security

More questions from this topic