Examkin

Question

Difficulty: MediumVPC Endpoints and PrivateLink Integration

A SysOps Administrator is configuring a private subnet containing Amazon EC2 instances that need to access files in an Amazon S3 bucket within the same AWS Region. To prevent data transfer charges and keep the traffic private, the administrator creates an Amazon S3 Gateway VPC Endpoint. However, when trying to access S3 from the EC2 instances, the connection times out. What configuration step must the administrator perform to resolve this connection issue?

  1. A
    Configure the private subnet route table to send all S3 traffic to a NAT Gateway.
  2. B
    Attach a security group to the Gateway VPC Endpoint that allows inbound HTTPS traffic from the EC2 instances.
  3. Associate the Gateway VPC Endpoint with the route table of the private subnet.Answer
  4. D
    Add a route to the private subnet route table pointing 0.0.0.0/00.0.0.0/0 to an Internet Gateway.

Answer

Associate the Gateway VPC Endpoint with the route table of the private subnet.
The correct action is to associate the S3 Gateway VPC Endpoint with the route table of the private subnet. Unlike Interface VPC Endpoints, Gateway VPC Endpoints do not use security groups or private DNS. Instead, they rely on prefix list routes automatically added to associated route tables.

Step-by-Step Solution

1
Identify the type of VPC Endpoint being used.
The administrator deployed a Gateway VPC Endpoint for Amazon S3.
Gateway VPC Endpoints require route table updates to direct traffic targeting the S3 prefix list to the endpoint, unlike Interface VPC Endpoints which rely on DNS and security groups.
2
Update the routing configuration for the subnet.
Associate the S3 Gateway VPC Endpoint with the route table of the private subnet where the EC2 instances reside.
This association automatically inserts a route pointing the S3 prefix list (e.g., pl-xxxxxx) to the endpoint (vpce-xxxxxx) as the target.
3
Verify network connectivity.
EC2 instances in the private subnet successfully connect to the S3 bucket privately without timeouts.
Traffic destined for S3 is now matched by the prefix list route and forwarded to the endpoint instead of timing out due to a lack of route.

Key Concept

Gateway VPC Endpoints (for S3 and DynamoDB) require explicit association with subnet route tables to automatically inject prefix list routes. They do not use security groups.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic