A company has two VPCs: VPC A with CIDR block 10.1.0.0/16 and VPC B with CIDR block 10.2.0… — AWS Certified SysOps Administrator - Associate

A company has two VPCs: VPC A with CIDR block $10.1.0.0/16$ and VPC B with CIDR block $10.2.0.0/16$ . The VPCs are connected using an AWS Transit Gateway. A SysOps administrator is troubleshooting a connectivity issue where Amazon EC2 instances in a private subnet ( $10.1.1.0/24$ ) of VPC A cannot connect to an Amazon RDS DB instance in a private subnet ( $10.2.2.0/24$ ) of VPC B.

The administrator verifies the following configuration details:
- The Transit Gateway route tables show active attachments and successful route propagation for both VPCs.
- The subnet route table for VPC A has a route for $10.2.0.0/16$ pointing to the Transit Gateway.
- The subnet route table for VPC B has a route for $10.1.0.0/16$ pointing to the Transit Gateway.
- The Network ACLs (NACLs) for all subnets in both VPCs allow all inbound and outbound traffic.

Which of the following is the most likely cause of this connection failure?

The security group associated with the RDS DB instance in VPC B references the security group ID of the EC2 instances in VPC A as its source.Answer
B
The security group associated with the RDS DB instance in VPC B is missing an outbound rule to allow return traffic to the ephemeral ports of the EC2 instances.
C
The route table associated with the RDS DB instance's subnet in VPC B is missing a route targeting the Internet Gateway (IGW) for return traffic.
D
The route table associated with the RDS DB instance's subnet in VPC B has a default route ( $0.0.0.0/0$ ) pointing to a NAT Gateway, which overrides the Transit Gateway route.

Answer

The security group associated with the RDS DB instance in VPC B references the security group ID of the EC2 instances in VPC A as its source.

The correct answer is that the database security group references the EC2 instances' security group ID. AWS Transit Gateway does not support security group referencing across VPC attachments. In contrast to VPC Peering within the same region, where you can reference security groups across VPCs, security groups across a Transit Gateway must allow traffic using CIDR blocks (e.g.,

10.1.0.0/16

10.1.1.0/24

) as the source.

Step-by-Step Solution

Analyze the network path between the EC2 instances in VPC A (

10.1.1.0/24

) and the RDS DB instance in VPC B (

10.2.2.0/24

Confirm that the routing is set up correctly in both VPC route tables and Transit Gateway route tables, and that stateless Network ACL rules are not blocking traffic.

Eliminates routing configuration and stateless firewalls as potential points of failure.

Evaluate the stateful firewall rules (Security Groups) on both ends.

Identify that the destination (RDS DB instance) security group uses a rule referencing the security group ID of the EC2 instances from the source VPC.

Security groups must permit the incoming database traffic (typically port 3306 for MySQL) from the source subnet or instance.

Determine the support for security group referencing over Transit Gateway.

Acknowledge that AWS Transit Gateway does not support referencing security groups across different VPCs (unlike VPC Peering in the same region).

This is a key technical limitation of Transit Gateway that causes security group rules based on ID references to evaluate as non-matching.

Recommend the resolution step.

Change the RDS security group inbound source from the EC2 security group ID to the CIDR block of VPC A (

10.1.0.0/16

) or the specific EC2 subnet (

10.1.1.0/24

Allows traffic from the private subnet range over the Transit Gateway connection.

Key Concept

AWS Transit Gateway Security Group Reference Limitation

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic