Examkin

Question

Difficulty: HardVPC Endpoints and PrivateLink Integration

A SysOps Administrator has configured an Interface VPC Endpoint for the Amazon EC2 service (com.amazonaws.us-east-1.ec2) to allow Amazon EC2 instances in a private subnet to call the Amazon EC2 API. The VPC has DNS support and DNS hostnames enabled, and the Interface VPC Endpoint has Private DNS enabled. The EC2 instances are associated with a security group that allows all outbound traffic. However, when attempting to run the command 'aws ec2 describe-instances' from one of the instances, the command hangs and eventually times out. Which of the following is the most likely cause of this issue?

  1. The security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances.Answer
  2. B
    The route table associated with the private subnet does not contain a route that targets the Interface VPC Endpoint ID for the destination traffic.
  3. C
    The private subnet's Network ACL does not have a rule allowing outbound traffic to the AWS public IP range for the EC2 service.
  4. D
    The EC2 instances are unable to resolve the public DNS endpoint of the EC2 service because there is no route to an Internet Gateway in the route table.

Answer

The security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances.
The correct answer is that the security group associated with the Interface VPC Endpoint does not allow inbound TCP port 443 traffic from the security group of the EC2 instances. Interface VPC Endpoints create Elastic Network Interfaces (ENIs) inside the subnet. The security group attached to these ENIs acts as a firewall. Since the AWS CLI communicates over HTTPS, the endpoint's security group must permit inbound traffic on TCP port 443 from the EC2 instances or their subnet CIDR.

Step-by-Step Solution

1
Analyze the symptom.
The AWS CLI command hangs and times out, indicating a network-level blockage (traffic is being dropped silently) rather than a DNS resolution failure (which would result in an immediate 'Could not resolve host' error).
Timeouts in AWS VPC environments typically point to security groups, network ACLs, or routing table issues dropping packets.
2
Evaluate the routing requirement.
Since this is an Interface VPC Endpoint (AWS PrivateLink), traffic is directed to the ENIs associated with the endpoint via DNS. No route table changes are required for the subnet.
Interface VPC Endpoints do not use Gateway-style route table entries.
3
Evaluate the security group configuration.
The security group on the EC2 instances allows all outbound traffic, but the security group on the VPC Endpoint's ENIs must allow inbound traffic on TCP port 443 from the EC2 instances.
Security groups are stateful, but inbound rules must still be explicitly configured on the destination (the endpoint ENI) to accept connection requests.

Key Concept

Security group configuration for Interface VPC Endpoints (AWS PrivateLink)
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic