A company is hosting a secure data processing application on Amazon EC2 instances in a pri… — AWS Certified Solutions Architect - Associate

A company is hosting a secure data processing application on Amazon EC2 instances in a private subnet (Subnet A: $172.16.1.0/24$ ) within a VPC ( $172.16.0.0/16$ ). To comply with strict security requirements, the instances must not have internet access. Instead, they must interact with AWS Systems Manager (SSM) using an Interface VPC Endpoint located in a dedicated endpoint subnet (Subnet B: $172.16.2.0/24$ ). Both subnets are associated with custom Network ACLs (NACLs) that currently deny all inbound and outbound traffic. The security groups associated with the EC2 instances and the VPC endpoint are already correctly configured to allow HTTPS traffic (TCP port $443$ ) between them. Which configuration must the solutions architect apply to the Network ACL of Subnet A to allow the EC2 instances to successfully establish connections to and communicate with the SSM Interface VPC Endpoint?

An outbound rule allowing TCP port $443$ to destination $172.16.2.0/24$ , and an inbound rule allowing TCP ports $1024$ - $65535$ from source $172.16.2.0/24$ .Answer
B
An outbound rule allowing TCP port $443$ to destination $172.16.2.0/24$ . No inbound rule is required because security groups are stateful and will automatically allow the return traffic.
C
An outbound rule allowing TCP port $443$ to destination $172.16.2.0/24$ , and an inbound rule allowing TCP port $443$ from source $172.16.2.0/24$ .
D
An inbound rule allowing TCP port $443$ from source $172.16.2.0/24$ , and an outbound rule allowing TCP ports $1024$ - $65535$ to destination $172.16.2.0/24$ .

Answer

An outbound rule allowing TCP port

443

to destination

172.16.2.0/24

, and an inbound rule allowing TCP ports

1024

65535

from source

172.16.2.0/24

Network ACLs are stateless. Therefore, to allow a connection, rules must allow traffic in both directions. The client EC2 instances initiate HTTPS traffic to the Systems Manager (SSM) Interface VPC Endpoint on port

443

, which requires an outbound rule to destination

172.16.2.0/24

on TCP port

443

. The return traffic from the SSM endpoint will be sent back to the client's dynamically allocated ephemeral ports (

1024

65535

). Consequently, an inbound rule from source

172.16.2.0/24

on TCP ports

1024

65535

is required to allow the response traffic.

Step-by-Step Solution

Identify the communication flow and port numbers.

The client EC2 instances in Subnet A initiate HTTPS traffic (TCP port

443

) to the Interface VPC Endpoint (which uses ENIs in Subnet B).

Systems Manager Interface VPC Endpoints receive traffic on HTTPS port

443

Determine the outbound Network ACL requirements for Subnet A.

An outbound rule allowing TCP traffic to destination

172.16.2.0/24

(Subnet B) on port

443

is required.

To allow the outbound request from the EC2 instances to reach the VPC Endpoint's network interfaces.

Determine the inbound Network ACL requirements for Subnet A considering NACL statelessness.

An inbound rule allowing TCP traffic from source

172.16.2.0/24

(Subnet B) on ephemeral ports

1024

65535

is required.

Network ACLs are stateless, meaning return traffic is not automatically allowed. When the EC2 instances initiate the connection, they use dynamically allocated source ports (ephemeral ports

1024

65535

), which will be the destination ports for the response traffic.

Key Concept

Statelessness of Network ACLs and the requirement of ephemeral ports for return traffic in VPC communications.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic