A SysOps administrator is troubleshooting a connectivity issue between an Amazon EC2 insta… — AWS Certified SysOps Administrator - Associate

A SysOps administrator is troubleshooting a connectivity issue between an Amazon EC2 instance in a private subnet of VPC A ( $10.10.1.0/24$ ) and a database instance in a private subnet of VPC B ( $10.20.2.0/24$ ). The two VPCs are connected via an AWS Transit Gateway. The administrator verifies the following configuration details:

1. Security Groups: The EC2 instance security group allows all outbound traffic, and the database security group allows inbound traffic on port $3306$ from VPC A's CIDR ( $10.10.0.0/16$ ).
2. Network ACLs: The Network ACLs for both subnets allow all inbound and outbound traffic.
3. Subnet Route Tables:
- VPC A's private subnet route table has a route: $10.20.0.0/16 \rightarrow$ tgw-0123456789abcdef0 (Transit Gateway).
- VPC B's private subnet route table has a route: $10.10.0.0/16 \rightarrow$ tgw-0123456789abcdef0 (Transit Gateway).
4. Transit Gateway Route Tables:
- The Transit Gateway has two route tables: `TGW-RT-1` and `TGW-RT-2`.
- The VPC A attachment is associated with `TGW-RT-1` and propagates its routes to `TGW-RT-2`.
- The VPC B attachment is associated with `TGW-RT-2` and propagates its routes to `TGW-RT-2`.

Which of the following explains why the EC2 instance cannot connect to the database?

The Transit Gateway route table `TGW-RT-1` lacks a route to VPC B because the VPC B attachment only propagates to `TGW-RT-2`.Answer
B
VPC A and VPC B are associated with different Transit Gateway route tables, which completely prevents them from routing traffic to each other.
C
The Network ACL associated with VPC B's subnet blocks the connection because stateless Network ACLs require explicit outbound rules for ephemeral ports $1024$ - $65535$ .
D
The subnet route table in VPC A must target the VPC B Transit Gateway attachment ID (`tgw-attach-xxxx`) rather than the Transit Gateway ID (`tgw-xxxx`).

Answer

The Transit Gateway route table `TGW-RT-1` lacks a route to VPC B because the VPC B attachment only propagates to `TGW-RT-2`.

The correct answer is that the Transit Gateway route table associated with VPC A (`TGW-RT-1`) does not have a route to VPC B because VPC B's attachment is only configured to propagate to `TGW-RT-2`. When a packet arrives at the Transit Gateway from an attachment, the Transit Gateway looks up the route table that is associated with that source attachment. In this case, it checks `TGW-RT-1` for a route to VPC B's CIDR (

10.20.2.0/24

). Because VPC B's attachment does not propagate to `TGW-RT-1`, no route exists, and the traffic is dropped.

Step-by-Step Solution

Trace the outbound traffic path from VPC A to VPC B.

The traffic leaves VPC A's private subnet and is routed to the Transit Gateway based on the VPC subnet route table entry (

10.20.0.0/16 \rightarrow

Transit Gateway).

This confirms that the initial VPC-level routing is correct.

Identify the Transit Gateway route table evaluated for packets arriving from VPC A.

The Transit Gateway evaluates `TGW-RT-1` because the VPC A attachment is associated with `TGW-RT-1`.

Transit Gateway routes incoming traffic based on the route table associated with the source attachment.

Check the routes present in `TGW-RT-1`.

There is no route to VPC B (

10.20.0.0/16

) in `TGW-RT-1` because the VPC B attachment only propagates to `TGW-RT-2`.

Propagations determine which route tables automatically learn the CIDRs of the attached VPCs. Since VPC B only propagates to `TGW-RT-2`, `TGW-RT-1` has no knowledge of VPC B's CIDR.

Determine the packet outcome.

The Transit Gateway drops the packet due to a missing route in the evaluated route table (`TGW-RT-1`).

Without a destination route in the associated route table, the traffic cannot be forwarded.

Key Concept

AWS Transit Gateway route evaluation depends on the association of the source attachment and the propagation of the destination attachment.

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic