Examkin

Question

Difficulty: MediumVPC Network Security

A media company hosts a microservices application across two different virtual private clouds (VPCs) in the same AWS Region: VPC A (10.10.0.0/1610.10.0.0/16) and VPC B (10.20.0.0/1610.20.0.0/16). The VPCs are connected using a VPC peering connection. The web microservice in VPC A needs to query a PostgreSQL database cluster running on Amazon EC2 instances in VPC B.

Which configuration should a solutions architect implement to secure network access to the database using the principle of least privilege?

  1. Configure the database security group in VPC B to allow inbound TCP port 54325432 traffic from the security group of the web microservice in VPC A.Answer
  2. B
    Configure the database security group in VPC B to allow inbound TCP port 54325432 traffic from the CIDR block of VPC A (10.10.0.0/1610.10.0.0/16).
  3. C
    Configure the Network ACL of the database subnet in VPC B to allow inbound TCP port 54325432 traffic from the security group of the web microservice in VPC A.
  4. D
    Configure the database security group in VPC B to allow inbound TCP port 54325432 traffic from the public IP addresses of the web microservice instances in VPC A.

Answer

Configure the database security group in VPC B to allow inbound TCP port 54325432 traffic from the security group of the web microservice in VPC A.
Referencing the security group ID of the web microservice in the database's security group rule is the recommended AWS best practice for peered VPCs. This ensures that only the instances explicitly associated with the web microservice security group can access the PostgreSQL database on port 54325432, maintaining strict isolation.

Step-by-Step Solution

1
Identify the network connection type.
The VPCs are peered via a VPC peering connection, meaning traffic routes privately using private IP addresses.
This rules out solutions using public IP addresses or public network gateways.
2
Determine the capabilities of security groups across peered VPCs.
AWS security groups can reference other security groups in peered VPCs as traffic sources or destinations.
This allows for fine-grained access control based on resource membership rather than broad CIDR blocks.
3
Evaluate the stateful vs. stateless resource control mechanisms.
Security groups are stateful and can filter traffic based on security group IDs, while Network ACLs are stateless and can only filter by CIDR blocks.
This confirms that referencing the web microservice security group within the database's security group is the only way to achieve least-privilege security.

Key Concept

Security Group Referencing across VPC Peering
Estimated Time:1m 30s
Rate this question

Topics

VPC Network Security

More questions from this topic