Examkin

Question

Difficulty: MediumVPC Network Security

A company is deploying an application on Amazon ECS using AWS Fargate within private subnets of a VPC. The application needs to retrieve sensitive configuration data from AWS Systems Manager Parameter Store. Due to strict security policies, the VPC does not have an internet gateway or a NAT gateway, and all traffic must remain within the AWS network. A solutions architect creates interface VPC endpoints for Systems Manager in the private subnets. However, the ECS tasks are failing to retrieve the configuration data. Which network security configuration is required to resolve this issue while maintaining the principle of least privilege?

  1. Configure the security group attached to the interface VPC endpoints to allow inbound HTTPS traffic on port 443 from the security group attached to the ECS tasks.Answer
  2. B
    Add an outbound rule to the private subnet's Network ACL to allow TCP traffic on port 443 to the interface VPC endpoint's subnet, without adding a corresponding inbound rule for return traffic.
  3. C
    Add a route to the private subnet's route table directing all traffic destined for the Systems Manager service to the interface VPC endpoint ID as the target.
  4. D
    Attach an AWS WAF web ACL directly to the interface VPC endpoint to inspect and authorize the inbound HTTPS traffic from the ECS tasks.

Answer

Configure the security group attached to the interface VPC endpoints to allow inbound HTTPS traffic on port 443 from the security group attached to the ECS tasks.
The correct configuration is to modify the security group attached to the interface VPC endpoint (which creates ENIs in the private subnets) to permit inbound HTTPS (port 443) traffic originating from the security group of the ECS Fargate tasks. Because security groups are stateful, this rule automatically allows the return traffic back to the ECS tasks.

Step-by-Step Solution

1
Analyze how AWS Fargate tasks resolve and connect to AWS Systems Manager in a private VPC without internet access.
The Fargate tasks use private DNS associated with the interface VPC endpoints to resolve the Systems Manager service endpoint to the private IP addresses of the endpoint's elastic network interfaces (ENIs).
Since there is no internet gateway or NAT gateway, all traffic must remain within the VPC using PrivateLink.
2
Determine the firewall requirements for the interface VPC endpoint ENIs.
The security group associated with the interface VPC endpoint must allow inbound traffic on port 443 (HTTPS) because Systems Manager APIs are HTTPS-based.
Security groups are stateful and act at the instance/ENI level, controlling incoming traffic to the endpoint.
3
Apply the principle of least privilege to the inbound rule.
Restrict the source of the inbound HTTPS rule on the endpoint's security group to the security group of the ECS Fargate tasks.
This ensures only authorized container tasks can access the Systems Manager Parameter Store via the endpoint.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require appropriate security group configurations to allow inbound traffic from the client resources. Unlike Gateway Endpoints, they do not use route tables; they rely on DNS resolution and stateful security groups.
Estimated Time:1m 30s
Rate this question

Topics

VPC Network Security

More questions from this topic