An organization has EC2 instances running in a private VPC subnet that must send log data to Amazon CloudWatch Logs. To comply with security policies, this traffic must remain entirely within the AWS network. A SysOps Administrator creates an Interface VPC Endpoint for CloudWatch Logs (com.amazonaws.us-east-1.logs) in the VPC. However, the EC2 instances are still unable to reach CloudWatch Logs, and application log agents report connection timeouts. Which of the following actions should the SysOps Administrator take to resolve this connectivity issue? (Select TWO.)
- Modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS traffic on port 443 from the security group of the EC2 instances.Answer
- Enable Private DNS on the Interface VPC Endpoint, and ensure that both DNS resolution and DNS hostnames are enabled for the VPC.Answer
- CAdd a route to the private subnet route table with com.amazonaws.us-east-1.logs as the destination and the Interface VPC Endpoint ID as the target.
- DAttach an Internet Gateway to the VPC, and add a route in the private subnet route table pointing to the Internet Gateway for all destination traffic.
Answer
To resolve the connectivity issue, the Administrator must modify the security group associated with the Interface VPC Endpoint to allow inbound HTTPS (port 443) traffic from the EC2 instances, and enable Private DNS on the endpoint along with DNS resolution and DNS hostnames in the VPC.
The correct options are to modify the endpoint's security group to allow inbound HTTPS traffic from the EC2 instances, and to enable Private DNS on the endpoint along with DNS hostnames and resolution on the VPC. This combination allows traffic to flow securely to the endpoint's ENIs and enables standard DNS queries to resolve to private endpoint IPs without code modifications.
Step-by-Step Solution
Key Concept
Interface VPC Endpoints rely on DNS resolution and security groups rather than route tables to secure private connectivity to AWS services.