An organization runs order processing microservices on Amazon EC2 instances in a private s… — AWS Certified Solutions Architect - Associate

An organization runs order processing microservices on Amazon EC2 instances in a private subnet ( $10.10.2.0/24$ ) within an Amazon VPC. These instances must securely query a database in a dedicated database subnet ( $10.10.3.0/24$ ). They must also access a third-party payment processing API through an Interface VPC Endpoint hosted in a utility subnet ( $10.10.4.0/24$ ) within the same VPC.

Custom Network ACLs (NACLs) are configured as follows:
- The private subnet NACL allows outbound TCP traffic to the database subnet on port $5432$ and outbound TCP traffic to the utility subnet on port $443$ .
- The database subnet NACL allows inbound TCP traffic on port $5432$ and outbound TCP traffic to the private subnet on ephemeral ports ( $1024-65535$ ).
- The utility subnet NACL allows inbound TCP traffic on port $443$ from the private subnet and outbound TCP traffic to the private subnet on ephemeral ports ( $1024-65535$ ).

Currently, the EC2 instances successfully connect to the database, but all HTTPS connection attempts to the third-party API via the Interface VPC Endpoint fail.

Which two actions should the solutions architect take to resolve this connectivity issue while maintaining least privilege? (Select TWO.)

Add an inbound rule to the private subnet Network ACL that allows TCP traffic from the utility subnet ( $10.10.4.0/24$ ) on ephemeral ports ( $1024-65535$ ).Answer
Configure the security group associated with the Interface VPC Endpoint to allow inbound TCP traffic on port $443$ from the security group associated with the EC2 instances.Answer
C
Add an outbound rule to the security group associated with the Interface VPC Endpoint to allow TCP traffic to the private subnet's security group on ephemeral ports ( $1024-65535$ ).
D
Add an outbound rule to the private subnet Network ACL that allows TCP traffic to the utility subnet ( $10.10.4.0/24$ ) on ephemeral ports ( $1024-65535$ ).
E
Attach an AWS WAF Web ACL to the Interface VPC Endpoint with a rule allowing inbound HTTPS traffic on ephemeral ports from the private subnet.

Answer

To resolve the connectivity issue, the solutions architect must add an inbound rule to the private subnet Network ACL allowing TCP traffic from the utility subnet on ephemeral ports, and configure the Interface VPC Endpoint's security group to allow inbound TCP traffic on port

443

from the EC2 instances' security group.

The correct options are the actions to add an inbound rule to the private subnet Network ACL allowing TCP traffic from the utility subnet on ephemeral ports, and to configure the Interface VPC Endpoint's security group to allow inbound TCP traffic on port

443

from the security group of the EC2 instances. Network ACLs are stateless firewalls. Although outbound traffic from the private subnet to the utility subnet is allowed on port

443

, the return traffic returning from the utility subnet uses ephemeral ports (

1024-65535

) and is blocked because the private subnet NACL does not have a rule allowing it. Adding the inbound rule resolves this. Additionally, since security groups are stateful, the security group for the Interface VPC Endpoint only needs to permit inbound traffic on port

443

from the EC2 instances. The response traffic is allowed automatically.

Step-by-Step Solution

Analyze the state of existing Network ACLs and connection flow.

The connection fails because Network ACLs are stateless. While outbound traffic from the private subnet to the utility subnet on port

443

is allowed, the return traffic from the utility subnet on ephemeral ports (

1024-65535

) is blocked at the private subnet boundary.

For stateless firewalls like NACLs, return traffic must be explicitly permitted by configuring an inbound rule with ephemeral port ranges.

Formulate the required Network ACL rule.

Add an inbound rule to the private subnet NACL that permits TCP traffic from the utility subnet (

10.10.4.0/24

) on destination ports

1024-65535

This allows return packets from the Interface VPC Endpoint to reach the initiating client instances in the private subnet.

Evaluate the stateful security group requirements.

The Interface VPC Endpoint must have a security group that permits inbound HTTPS traffic (TCP port

443

) from the EC2 instances' security group.

Since security groups are stateful, return traffic is automatically tracked and allowed outbound, making any outbound security group rules for ephemeral ports unnecessary.

Key Concept

Understanding the stateless behavior of Network ACLs compared to the stateful behavior of Security Groups, and configuring ephemeral ports correctly for return traffic.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic