Examkin

Question

Difficulty: HardVPC Connectivity and Routing Troubleshooting

A SysOps Administrator is troubleshooting a connectivity issue where Amazon EC2 instances in a private subnet (10.0.1.0/2410.0.1.0/24) are incurring high data transfer charges when downloading large datasets from Amazon S3. The administrator discovers that the traffic is currently routed through a NAT Gateway. To resolve this and keep the traffic private, the administrator creates a Gateway VPC Endpoint for Amazon S3 in the VPC. However, the EC2 instances continue to route traffic to S3 through the NAT Gateway. Which of the following configuration steps must the administrator take to ensure the S3 traffic is routed through the Gateway VPC Endpoint? (Select TWO.)

  1. Associate the private subnet's route table with the S3 Gateway VPC Endpoint.Answer
  2. Verify that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list.Answer
  3. C
    Add a static route to the private subnet's route table for the Amazon S3 DNS endpoint targeting the Internet Gateway (IGW).
  4. D
    Enable private DNS hostnames on the Amazon S3 Gateway VPC Endpoint.
  5. E
    Update the public subnet's route table to route traffic destined for the S3 prefix list through the NAT Gateway.

Answer

To resolve the routing issue, the administrator must associate the private subnet's route table with the S3 Gateway VPC Endpoint and verify that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list.
The correct options are associating the private subnet's route table with the S3 Gateway VPC Endpoint and verifying that the outbound rules of the security group attached to the EC2 instances allow traffic to the Amazon S3 prefix list. Route table association is required because AWS automatically adds a route pointing to the VPC endpoint with the destination set to the S3 prefix list. Stateful security groups must also explicitly allow outbound traffic to the S3 prefix list for the instances to successfully establish connections.

Step-by-Step Solution

1
Associate the private subnet's route table with the S3 Gateway VPC Endpoint.
AWS automatically injects a route into the subnet's route table with the destination set to the Amazon S3 prefix list (e.g., pl-xxxx) and the target pointing to the Gateway VPC Endpoint (e.g., vpce-xxxx).
This updates the VPC router to direct traffic destined for S3 to the gateway endpoint instead of the default route (0.0.0.0/00.0.0.0/0) pointing to the NAT Gateway.
2
Ensure the stateful security group associated with the EC2 instances allows outbound traffic to the S3 prefix list.
The security group authorizes egress traffic to S3 endpoints.
Security groups are stateful and evaluate outbound traffic rules. Even if the route table points to the gateway endpoint, the instance's security group must explicitly permit outbound traffic to the S3 IP prefix list.

Key Concept

Gateway VPC Endpoints use prefix-list routing in subnet route tables to direct traffic privately to AWS services like S3, and stateful security groups must permit the outbound connection.
Rate this question

Topics

VPC Connectivity and Routing Troubleshooting

More questions from this topic