Examkin

Question

Difficulty: HardVPC Endpoints and PrivateLink Integration

An application running on Amazon EC2 instances in a private subnet of a VPC needs to access a proprietary database service hosted by a partner company in another AWS account. The partner has shared the service via an AWS PrivateLink VPC Endpoint Service. The SysOps Administrator has created an Interface VPC Endpoint in the private subnet targeting the partner's service.

However, application logs show that connection attempts to the Interface VPC Endpoint's DNS name are failing due to connection timeouts.

Which TWO configurations must the SysOps Administrator verify or implement to resolve this connection issue? (Select TWO.)

  1. Verify that the security group attached to the Interface VPC Endpoint has an inbound rule allowing traffic on the database port from the security group of the EC2 instances.Answer
  2. Verify that the VPC Endpoint connection status is Accepted, indicating that the service provider has approved the connection request.Answer
  3. C
    Verify that the route table associated with the private subnet contains a route pointing to the Interface VPC Endpoint ID (vpce-xxxxxx) for the destination database service.
  4. D
    Enable the Private DNS Hostnames option on the Interface VPC Endpoint configuration to ensure the partner's custom domain name resolves inside the VPC.

Answer

Verify that the security group attached to the Interface VPC Endpoint allows inbound traffic on the database port from the EC2 instances' security group, and verify that the VPC Endpoint connection status is Accepted by the service provider.
The correct configurations involve ensuring the security group associated with the Interface VPC Endpoint permits inbound traffic on the database port from the EC2 instances, and verifying that the endpoint connection has been accepted by the service provider. Interface VPC Endpoints create network interfaces inside the VPC that act as targets for DNS queries, requiring appropriate security group rules to accept traffic. Additionally, connections to a PrivateLink service provider in another account remain in a pending state and drop traffic until explicitly accepted by the provider.

Step-by-Step Solution

1
Check the status of the VPC Endpoint in the Amazon VPC console.
Verify that the connection state is 'Available' rather than 'PendingAcceptance'.
Traffic cannot flow through a PrivateLink connection if the provider has not accepted the connection request.
2
Examine the security group rules associated with the Interface VPC Endpoint's network interfaces.
Ensure there is an inbound rule permitting TCP traffic on the database port from the security group of the source EC2 instances.
Interface Endpoints create Elastic Network Interfaces (ENIs) inside the VPC, which are protected by security groups. If the security group blocks inbound traffic on the service port, the connection will time out.
3
Verify that route tables do not need modifications.
Confirm that no routes pointing to the endpoint ID are added to the subnet route tables.
Interface VPC Endpoints rely on DNS resolution to direct traffic, not subnet routing table paths.

Key Concept

Troubleshooting AWS PrivateLink interface endpoints, ensuring connection acceptance by the service provider, and configuring security group rules for endpoint network interfaces.
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic