A company is deploying a secure processing application on Amazon EC2 instances in a privat… — AWS Certified Solutions Architect - Associate

A company is deploying a secure processing application on Amazon EC2 instances in a private subnet (Subnet A: $10.0.1.0/24$ ). The EC2 instances must receive HTTPS requests on port $443$ from an internal Application Load Balancer (ALB) located in another private subnet (Subnet B: $10.0.2.0/24$ ). Additionally, the EC2 instances must securely retrieve configuration files from an Amazon S3 bucket. The company's security policy mandates that Subnet A must use a custom Network ACL (NACL) configured with a default-deny posture to block all unspecified traffic, and no traffic is allowed to transit the internet. Currently, a Gateway VPC Endpoint is used for Amazon S3, but the EC2 instances cannot connect to S3, and the ALB health checks are failing.

Which TWO actions should a solutions architect take to resolve these connectivity issues while complying with the security policy? (Select TWO.)

Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet ( $10.0.2.0/24$ ) on port $443$ , and allow outbound traffic to the ALB subnet ( $10.0.2.0/24$ ) on ephemeral ports ( $1024-65535$ ).Answer
Replace the S3 Gateway VPC Endpoint with an Interface VPC Endpoint for Amazon S3, and configure the Network ACL of Subnet A to allow outbound traffic to the private IP addresses of the interface endpoint on port $443$ , and inbound traffic from those private IP addresses on ephemeral ports ( $1024-65535$ ).Answer
C
Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet ( $10.0.2.0/24$ ) on port $443$ , and rely on the stateful behavior of the EC2 Security Groups to automatically permit the outbound return traffic.
D
Modify the Network ACL of Subnet A to allow outbound traffic on port $443$ to the Amazon S3 prefix list (pl-xxxxxx) and allow inbound traffic from the prefix list on ephemeral ports ( $1024-65535$ ).
E
Configure the Network ACL of Subnet A to allow outbound traffic to the Amazon S3 Gateway Endpoint public IP addresses on port $443$ , and rely on the default rule of the Network ACL to allow the inbound return traffic.

Answer

Configure the Network ACL of Subnet A to allow inbound traffic from the ALB subnet on port

443

and outbound traffic on ephemeral ports, and replace the S3 Gateway VPC Endpoint with an Interface VPC Endpoint while allowing traffic to its private IP addresses.

The correct configuration requires addressing two separate network flows under a stateless network security model. First, for the ALB communication, because Network ACLs are stateless, allowing inbound traffic on port

443

from the ALB subnet must be paired with allowing outbound return traffic on the ephemeral port range (

1024-65535

) back to the ALB subnet. Second, for the S3 communication, Gateway VPC Endpoints utilize public IP addresses and routing tables, which would require opening the Network ACL to broad public ranges or a wildcard (

0.0.0.0/0

). By replacing it with an Interface VPC Endpoint, S3 traffic uses private IP addresses, enabling the Network ACL to restrict outbound traffic to those specific private IPs on port

443

and inbound return traffic on ephemeral ports, adhering to the company's strict security requirements.

Step-by-Step Solution

Analyze the stateless behavior of Network ACLs (NACLs) for the ALB traffic.

Since NACLs are stateless, they evaluate traffic in both directions independently. To allow inbound HTTPS requests from the ALB on port

443

, the NACL must allow inbound port

443

from the ALB subnet and outbound ephemeral ports (

1024-65535

) to the ALB subnet for the return traffic.

Health checks and client requests from the ALB will fail if the stateless NACL blocks the return traffic.

Evaluate the limitations of Gateway VPC Endpoints with custom default-deny NACLs.

Gateway Endpoints route traffic to S3's public IP addresses. NACLs do not support S3 prefix lists, meaning the NACL would require allowing outbound traffic to

0.0.0.0/0

on port

443

and inbound return traffic on ephemeral ports. This violates the security policy that prohibits internet-bound routes.

NACL rules only accept CIDR blocks, not logical constructs like AWS prefix lists.

Determine the secure alternative for S3 connectivity.

By using an Interface VPC Endpoint (powered by AWS PrivateLink) for S3, the endpoint is assigned private IP addresses from the VPC. The NACL can then be configured with highly restrictive rules allowing outbound HTTPS traffic only to these specific private IP addresses.

This maintains the strict default-deny and no-internet-transit policies while restoring S3 connectivity.

Key Concept

Stateless Network ACL configuration requires managing return traffic explicitly, and Interface Endpoints allow private IP-based NACL filtering unlike Gateway Endpoints.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic