A SysOps Administrator has deployed an Amazon EC2 instance in a newly created subnet. The instance has been assigned a public IPv4 address, and its security group is configured to allow all outbound traffic and inbound SSH traffic from the administrator's IP address. However, the administrator is unable to establish an SSH connection to the instance, and the instance cannot reach external internet-based repositories. Which two configurations should the administrator verify to resolve this connectivity issue?
- Confirm that the subnet's route table contains a route for targeting the Internet Gateway.Answer
- Confirm that the subnet's network access control list (network ACL) allows outbound traffic on ephemeral ports .Answer
- CConfirm that the instance's security group allows inbound traffic on ephemeral ports from the internet.
- DConfirm that a Gateway VPC endpoint is associated with the subnet's route table.
- EConfirm that the EC2 instance's IAM role includes the `iam:PassRole` permission.
Answer
Verify that the subnet's route table contains a route for targeting the Internet Gateway, and verify that the subnet's network ACL allows outbound traffic on ephemeral ports .
For an EC2 instance in a VPC to communicate with the internet, it must be located in a public subnet, which is defined by having a route table entry pointing to an Internet Gateway. Additionally, because Network ACLs are stateless, outbound rules must explicitly permit return traffic to client connections on ephemeral ports ().
Step-by-Step Solution
Key Concept
VPC public routing requires a route to an Internet Gateway, and stateless Network ACLs require explicit configuration of outbound ephemeral ports to allow response traffic.