A company runs applications on Amazon EC2 instances in a private subnet. The applications must securely retrieve API keys from AWS Secrets Manager. To keep the traffic within the AWS network, a SysOps Administrator deploys an Interface VPC Endpoint for Secrets Manager (com.amazonaws.us-east-1.secretsmanager). However, connection attempts from the EC2 instances to the Secrets Manager service keep timing out. Which of the following actions will resolve this issue?
- Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances.Answer
- BAdd a route to the private subnet's route table with the destination pointing to the AWS Secrets Manager prefix list and the target pointing to the VPC endpoint ID.
- CConfigure the private subnet's route table to direct all Secrets Manager API traffic through a NAT Gateway residing in a public subnet.
- DUpdate the subnet's network ACL to allow outbound ephemeral ports to the public internet while blocking all inbound traffic from port 443.
Answer
Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances.
The correct action is to modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on TCP port 443 from the security group of the EC2 instances. Interface VPC Endpoints provision Elastic Network Interfaces (ENIs) inside the VPC subnets. These ENIs are secured by security groups. Since the API clients (the EC2 instances) communicate with these ENIs over HTTPS, the security group attached to the endpoint must allow inbound traffic on TCP port 443 from the EC2 instances' security group or subnet.
Step-by-Step Solution
Key Concept
Interface VPC Endpoints rely on security groups to control inbound access to their ENIs, whereas routing is handled via DNS (Private DNS) rather than route table entries.