Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring Amazon EC2 instances in a private subnet with no internet access to be managed by AWS Systems Manager Session Manager. The Administrator creates the required Interface VPC Endpoints for the `ssm`, `ssmmessages`, and `ec2messages` services within the VPC. The security group for the Interface VPC Endpoints is configured to allow inbound HTTPS traffic from the EC2 instances. However, the SSM Agent on the EC2 instances fails to connect to the Systems Manager service.

Which of the following is the most likely cause of this issue?

  1. A
    The route table associated with the private subnet is missing routes that target the Interface VPC Endpoints for the Systems Manager services.
  2. Private DNS hostnames are disabled for the Interface VPC Endpoints, causing the SSM Agent to attempt to resolve the default public Systems Manager endpoints instead of the private endpoints.Answer
  3. C
    The private subnet is missing a route targeting an Internet Gateway in its route table to allow the SSM Agent to perform DNS resolution.
  4. D
    The security group associated with the Interface VPC Endpoints does not allow outbound UDP traffic on port 53 to the VPC's AmazonProvidedDNS resolver.

Answer

Private DNS hostnames are disabled for the Interface VPC Endpoints, causing the SSM Agent to attempt to resolve the default public Systems Manager endpoints instead of the private endpoints.
Enabling Private DNS hostnames allows the default public service endpoints to resolve to the private IP addresses of the Interface VPC Endpoint's Elastic Network Interfaces (ENIs). Since the EC2 instances do not have internet access, they cannot reach the public IPs of the service endpoints. Enabling Private DNS ensures the connection remains internal and secure.

Step-by-Step Solution

1
Analyze the connection requirements for the Systems Manager (SSM) Agent.
The SSM Agent needs to connect to the Systems Manager service endpoints (ssm, ssmmessages, ec2messages).
To establish a Session Manager session, the SSM Agent on the EC2 instances must communicate with these endpoints.
2
Evaluate why the connection fails despite correct security groups and lack of internet access.
Without Private DNS hostnames enabled, the agent attempts to resolve the standard public endpoints (e.g., ssm.us-east-1.amazonaws.com) which resolve to public IP addresses.
Since the private subnet has no internet access, attempts to connect to public IP addresses will time out.
3
Determine the correct configuration to force private routing.
Enable Private DNS hostnames on the Interface VPC Endpoints.
This automatically overrides the public DNS names to resolve to the private IPs of the endpoint's elastic network interfaces within the VPC.

Key Concept

VPC Endpoints and PrivateLink Integration
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic