A company hosts an application on Amazon EC2 instances in a private subnet. The instances must access files in an Amazon S3 bucket within the same AWS Region without traversing the public internet. A SysOps administrator creates an Amazon S3 gateway VPC endpoint to enable this private connection. However, the instances are still unable to communicate with the S3 bucket. Which two configuration steps must the SysOps administrator take to resolve this connectivity issue? (Select TWO.)
- Add a route to the private subnet's route table that targets the gateway VPC endpoint for the Amazon S3 prefix list destination.Answer
- Configure the security group of the EC2 instances to allow outbound HTTPS traffic targeting the prefix list of the Amazon S3 gateway endpoint.Answer
- CEnable private DNS hostnames and DNS resolution options within the VPC settings.
- DAdd a route in the private subnet's route table with a destination of targeting the Internet Gateway (IGW).
- EConfigure the private subnet's network ACL to allow outbound HTTPS () traffic to the Amazon S3 prefix list without adding an inbound rule for ephemeral ports ().
Answer
To establish private connectivity to Amazon S3 using a gateway VPC endpoint, you must add a route targeting the VPC endpoint in the private subnet's route table and ensure that the EC2 instances' security group allows outbound HTTPS traffic to the S3 prefix list.
The correct options involve adding a route to the private subnet's route table that targets the gateway VPC endpoint for the S3 prefix list, and configuring the EC2 security group to allow outbound HTTPS traffic to the S3 prefix list. The gateway endpoint relies on the route table association to direct traffic, and stateful security groups must permit outbound traffic to the destination.
Step-by-Step Solution
Key Concept
Gateway VPC Endpoint Routing and Security Group Configuration
Estimated Time:2m 0s