An enterprise is deploying a payment processing engine on Amazon EC2 instances in Subnet A… — AWS Certified Solutions Architect - Associate

An enterprise is deploying a payment processing engine on Amazon EC2 instances in Subnet A (CIDR $10.0.1.0/24$ ) of a VPC. The instances must query a database service exposed via an Interface VPC Endpoint located in Subnet B (CIDR $10.0.2.0/24$ ) within the same VPC. The database listens on TCP port $3306$ . The network architecture mandates that Subnet A and Subnet B use custom, non-default Network Access Control Lists (NACLs). Which combination of Security Group (SG) and NACL configurations will allow successful communication while adhering to the principle of least privilege?

A
For the EC2 instances SG: Outbound rule allowing TCP port $3306$ to the Interface Endpoint SG, and Inbound rule allowing TCP ports $1024-65535$ from the Interface Endpoint SG. For the Interface Endpoint SG: Inbound rule allowing TCP port $3306$ from the EC2 instances SG, and Outbound rule allowing TCP ports $1024-65535$ to the EC2 instances SG. For Subnet A NACL: Outbound rule allowing TCP port $3306$ to $10.0.2.0/24$ . For Subnet B NACL: Inbound rule allowing TCP port $3306$ from $10.0.1.0/24$ .
B
For the EC2 instances SG: Outbound rule allowing TCP port $3306$ to the Interface Endpoint SG. For the Interface Endpoint SG: Inbound rule allowing TCP port $3306$ from the EC2 instances SG. For Subnet A NACL: Outbound rule allowing TCP port $3306$ to the Interface Endpoint SG, and Inbound rule allowing TCP ports $1024-65535$ from the Interface Endpoint SG. For Subnet B NACL: Inbound rule allowing TCP port $3306$ from the EC2 instances SG, and Outbound rule allowing TCP ports $1024-65535$ to the EC2 instances SG.
For the EC2 instances SG: Outbound rule allowing TCP port $3306$ to the Interface Endpoint SG. For the Interface Endpoint SG: Inbound rule allowing TCP port $3306$ from the EC2 instances SG. For Subnet A NACL: Outbound rule allowing TCP port $3306$ to $10.0.2.0/24$ , and Inbound rule allowing TCP ports $1024-65535$ from $10.0.2.0/24$ . For Subnet B NACL: Inbound rule allowing TCP port $3306$ from $10.0.1.0/24$ , and Outbound rule allowing TCP ports $1024-65535$ to $10.0.1.0/24$ .Answer
D
For the EC2 instances SG: Outbound rule allowing TCP port $3306$ to $10.0.2.0/24$ . For the Interface Endpoint SG: Inbound rule allowing TCP port $3306$ from $10.0.1.0/24$ . For Subnet A NACL: Outbound rule allowing TCP port $3306$ to $10.0.2.0/24$ . For Subnet B NACL: Inbound rule allowing TCP port $3306$ from $10.0.1.0/24$ .

Answer

The correct configuration uses stateful Security Groups targeting port

3306

without reverse rules, and stateless Network ACLs that explicitly permit the request on port

3306

and the response traffic on ephemeral ports

1024-65535

between the two subnet CIDRs.

Security Groups are stateful. When the EC2 instance initiates a connection to the database endpoint on port

3306

, the Security Group automatically allows the return traffic. Therefore, the EC2 Security Group only requires an outbound rule to the Endpoint Security Group, and the Endpoint Security Group only requires an inbound rule from the EC2 Security Group. Conversely, Network ACLs are stateless. Subnet A's NACL must explicitly allow the outbound request to Subnet B on port

3306

, and it must also allow the inbound return traffic from Subnet B on the ephemeral port range (

1024-65535

). Similarly, Subnet B's NACL must allow the inbound request on port

3306

and the outbound return traffic to Subnet A on the ephemeral port range (

1024-65535

Step-by-Step Solution

Configure the Security Groups for the initiating client and the receiving endpoint.

EC2 Security Group allows outbound TCP

3306

to the Endpoint Security Group; Endpoint Security Group allows inbound TCP

3306

from the EC2 Security Group.

Since Security Groups are stateful, return traffic is automatically allowed, meaning no inbound ephemeral rules are required on the client side, and no outbound rules are required on the endpoint side.

Configure the Network ACL rules for Subnet A (the EC2 client subnet).

Subnet A NACL allows outbound TCP

3306

to the destination subnet CIDR (

10.0.2.0/24

) and inbound TCP

1024-65535

(ephemeral ports) from the destination subnet CIDR.

Network ACLs are stateless, so the return packets sent from the database to the client's ephemeral ports must be explicitly permitted inbound.

Configure the Network ACL rules for Subnet B (the VPC Endpoint subnet).

Subnet B NACL allows inbound TCP

3306

from the client subnet CIDR (

10.0.1.0/24

) and outbound TCP

1024-65535

to the client subnet CIDR.

Because Network ACLs are stateless, the outbound response traffic returning to the client's ephemeral ports must be explicitly allowed outbound.

Key Concept

VPC Network Security: Stateful Security Groups vs. Stateless Network ACLs

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic