Examkin

Question

Difficulty: HardVPC Security Controls and Traffic Analysis

A SysOps Administrator is troubleshooting a configuration issue in a VPC. EC2 instances in a private subnet must access an Amazon S3 bucket to retrieve datasets. To comply with security policies and avoid data transfer processing costs, the administrator created an Amazon S3 Gateway VPC Endpoint. However, during a traffic analysis, the administrator observes that data transfer charges for the NAT Gateway are still increasing.

An inspection of the VPC Flow Logs for the EC2 instance's elastic network interface (ENI) reveals the following entry:

2 123456789012 eni-08a7b6c5d4e3f2g10 10.0.2.14 52.216.184.147 49320 443 6 40 2400 1781308800 1781308860 ACCEPT OK

Which action must the administrator take to ensure S3 traffic is routed through the S3 Gateway VPC Endpoint?

  1. Update the route table associated with the private subnet by adding a route that targets the S3 Gateway VPC Endpoint (vpce-xxxxxxxx) for the Amazon S3 prefix list destination (pl-xxxxxxxx).Answer
  2. B
    Modify the private subnet's route table to add a default route (0.0.0.0/0) targeting the S3 Gateway VPC Endpoint, and delete the existing route to the NAT Gateway.
  3. C
    Attach an Internet Gateway to the VPC, and add a route in the private subnet's route table targeting the Internet Gateway for the S3 prefix list destination.
  4. D
    Create an Amazon S3 Interface VPC Endpoint (PrivateLink) in the private subnet, and modify the EC2 instance's security group to allow outbound traffic to the Interface Endpoint's private IP addresses.

Answer

Update the route table associated with the private subnet by adding a route that targets the S3 Gateway VPC Endpoint (vpce-xxxxxxxx) for the Amazon S3 prefix list destination (pl-xxxxxxxx).
The correct action is to update the route table associated with the private subnet by adding a route that targets the S3 Gateway VPC Endpoint for the Amazon S3 prefix list. Gateway VPC Endpoints function by intercepting traffic destined for a specific AWS service (in this case, S3) using prefix list routes. If the route table is not updated to point the prefix list destination to the endpoint, the traffic will fallback to the default route (0.0.0.0/0) through the NAT Gateway, incurring data transfer processing fees.

Step-by-Step Solution

1
Analyze the VPC Flow Log entry.
The flow log entry shows an accepted connection (ACCEPT OK) from the EC2 private IP (10.0.2.14) to a public IP destination (52.216.184.147) on port 443. The destination IP belongs to the public S3 service range.
Before making changes, the administrator must confirm that traffic is still being directed to S3's public IP range and is traversing the NAT Gateway via the default route.
2
Check the route table of the private subnet.
The route table has a default route (0.0.0.0/0) pointing to the NAT Gateway, but lacks a route for the S3 prefix list (pl-xxxxxxxx) targeting the S3 Gateway VPC Endpoint (vpce-xxxxxxxx).
Gateway VPC Endpoints require explicit route table entries to redirect traffic from the default route to the private VPC endpoint route.
3
Add the S3 prefix list route to the private subnet's route table.
A new route is added with the destination 'pl-xxxxxxxx' (representing all S3 IP prefixes in the region) and the target 'vpce-xxxxxxxx'.
This configuration ensures that traffic destined for S3 bypasses the NAT Gateway and goes directly to S3 via the VPC local backbone, avoiding NAT Gateway processing charges.

Key Concept

Gateway VPC Endpoints use prefix list routing in subnet route tables to route traffic privately and cost-effectively to S3 and DynamoDB without traversing NAT Gateways.
Rate this question

Topics

VPC Security Controls and Traffic Analysis

More questions from this topic