An application hosted on Amazon EC2 instances in a private subnet (Subnet A: 10.0.1.0/24) … — AWS Certified Solutions Architect - Associate

An application hosted on Amazon EC2 instances in a private subnet (Subnet A: $10.0.1.0/24$ ) of a VPC must securely access AWS Key Management Service (AWS KMS) to decrypt sensitive transactional payloads. Compliance policies dictate that all traffic must remain within the AWS network, and no NAT Gateways or Internet Gateways are allowed. A solutions architect deploys an Interface VPC Endpoint for AWS KMS in a separate private subnet (Subnet B: $10.0.2.0/24$ ). Both subnets are associated with custom Network Access Control Lists (NACL A and NACL B) that currently deny all traffic. To achieve this secure communication while adhering to the principle of least privilege, which combination of Security Group and Network ACL rules is required?

A
EC2 Security Group allows outbound TCP $443$ and inbound TCP $1024$ - $65535$ . KMS Endpoint Security Group allows inbound TCP $443$ and outbound TCP $1024$ - $65535$ . NACL A allows outbound TCP $443$ to $10.0.2.0/24$ . NACL B allows inbound TCP $443$ from $10.0.1.0/24$ .
B
EC2 Security Group allows outbound TCP $443$ to the KMS Endpoint Security Group. KMS Endpoint Security Group allows inbound TCP $443$ from the EC2 Security Group. NACL A allows outbound TCP $1024$ - $65535$ to $10.0.2.0/24$ and inbound TCP $443$ from $10.0.2.0/24$ . NACL B allows inbound TCP $1024$ - $65535$ from $10.0.1.0/24$ and outbound TCP $443$ to $10.0.1.0/24$ .
EC2 Security Group allows outbound TCP $443$ to the KMS Endpoint Security Group. KMS Endpoint Security Group allows inbound TCP $443$ from the EC2 Security Group. NACL A allows outbound TCP $443$ to $10.0.2.0/24$ and inbound TCP $1024$ - $65535$ from $10.0.2.0/24$ . NACL B allows inbound TCP $443$ from $10.0.1.0/24$ and outbound TCP $1024$ - $65535$ to $10.0.1.0/24$ .Answer
D
EC2 Security Group allows outbound TCP $443$ . KMS Endpoint Security Group allows inbound TCP $443$ . NACL A allows outbound TCP $443$ to $10.0.2.0/24$ . NACL B allows inbound TCP $443$ from $10.0.1.0/24$ . Associate an AWS WAF web ACL with the KMS Interface VPC Endpoint to inspect and allow only KMS decrypt operations.

Answer

Configure the EC2 Security Group to allow outbound TCP

443

to the KMS Endpoint Security Group, and the KMS Endpoint Security Group to allow inbound TCP

443

from the EC2 Security Group. Configure NACL A to allow outbound TCP

443

10.0.2.0/24

and inbound TCP

1024

65535

from

10.0.2.0/24

. Configure NACL B to allow inbound TCP

443

from

10.0.1.0/24

and outbound TCP

1024

65535

10.0.1.0/24

The correct option correctly accounts for the stateful nature of Security Groups and the stateless nature of Network ACLs. Security Groups only require rules allowing the flow in the direction of connection establishment (outbound TCP

443

on the client side, inbound TCP

443

on the server side). Network ACLs require explicit rules for both the initial outbound request (to destination port

443

) and the corresponding inbound return packet (to destination ephemeral ports

1024

65535

) on the client subnet, and vice versa on the server subnet.

Step-by-Step Solution

Determine Security Group configurations based on their stateful nature.

EC2 instances initiate traffic to the KMS endpoint on port

443

. Because Security Groups are stateful, the EC2 SG only needs an outbound rule to the KMS SG, and the KMS SG only needs an inbound rule from the EC2 SG. Return traffic is automatically tracked and allowed.

Security Groups track connections and allow response traffic to flow back without needing explicit reverse rules.

Analyze the client-server interaction to identify ports for the stateless Network ACL rules.

The client (EC2 in Subnet A) sends traffic from an ephemeral source port (range

1024

65535

) to the server (KMS Endpoint in Subnet B) on destination port

443

. The return traffic flows from source port

443

to the destination ephemeral port.

Stateless Network ACLs evaluate inbound and outbound packets independently and require rules for both request and response paths.

Define rules for NACL A (Subnet A).

Outbound rule: Allow TCP destination port

443

to Subnet B (

10.0.2.0/24

). Inbound rule: Allow TCP destination ports

1024

65535

(ephemeral range) from Subnet B (

10.0.2.0/24

NACL A must allow the outgoing requests to reach the endpoint subnet and allow the returning server responses back into the subnet.

Define rules for NACL B (Subnet B).

Inbound rule: Allow TCP destination port

443

from Subnet A (

10.0.1.0/24

). Outbound rule: Allow TCP destination ports

1024

65535

(ephemeral range) to Subnet A (

10.0.1.0/24

NACL B must allow the incoming requests to reach the KMS endpoint and allow the outgoing responses to return to the EC2 instances.

Key Concept

Stateless Network ACLs vs Stateful Security Groups

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic