Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator creates a Gateway VPC Endpoint for Amazon S3 in a VPC. However, EC2 instances in a private subnet continue to access Amazon S3 through a NAT Gateway, resulting in high NAT Gateway data processing charges. Which configuration issue is the root cause of this behavior?

  1. A
    The private subnet's route table is missing a route targeting the Internet Gateway for the S3 prefix list.
  2. The Gateway VPC Endpoint was not associated with the route table of the private subnet.Answer
  3. C
    The private subnet's route table directs S3 traffic to the NAT Gateway in the public subnet instead of the VPC Endpoint's network interface.
  4. D
    The Network Access Control List (NACL) associated with the private subnet is blocking outbound ephemeral ports to S3.

Answer

The Gateway VPC Endpoint was not associated with the route table of the private subnet.
The correct answer is that the Gateway VPC Endpoint was not associated with the route table of the private subnet. For Gateway VPC Endpoints, AWS automatically updates the associated route tables with a prefix list route pointing to the endpoint. If the route table is not associated, traffic destined for Amazon S3 falls back to the default route, which in this case points to the NAT Gateway.

Step-by-Step Solution

1
Analyze how Gateway VPC Endpoints route traffic.
Gateway VPC Endpoints for S3 or DynamoDB require association with one or more VPC route tables.
Associating the endpoint with a route table automatically creates a routing entry with the service prefix list as the destination and the gateway endpoint ID as the target.
2
Determine the path of traffic when route table association is missing.
If the subnet's route table is not associated with the Gateway VPC Endpoint, traffic destined for S3 will match the default route (0.0.0.0/00.0.0.0/0) which points to the NAT Gateway.
Without the specific prefix list route pointing to the endpoint, the traffic must follow the standard internet path configured for the private subnet.
3
Identify the configuration fix to stop using the NAT Gateway.
Associate the Gateway VPC Endpoint with the private subnet's route table.
This updates the route table automatically and redirects S3 traffic locally and privately, bypassing the NAT Gateway entirely.

Key Concept

Gateway VPC Endpoints must be associated with subnet route tables to redirect traffic privately without using a NAT Gateway.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic