Examkin

Question

Difficulty: EasyVPC Endpoints and PrivateLink Integration

An organization runs EC2 instances in a private VPC subnet that must access AWS Secrets Manager. A SysOps Administrator deploys an Interface VPC Endpoint for Secrets Manager inside the subnet to keep the traffic private. However, the EC2 instances are unable to connect to Secrets Manager. Which of the following actions will resolve this connectivity issue?

  1. A
    Add a route to the subnet route table pointing to the Interface VPC Endpoint ID as the target for Secrets Manager traffic.
  2. Configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS traffic from the EC2 instances.Answer
  3. C
    Deploy a NAT Gateway in a public subnet and add a route in the private subnet route table to direct Secrets Manager traffic through it.
  4. D
    Add a route in the subnet route table pointing to an Internet Gateway to allow direct access to the public Secrets Manager endpoints.

Answer

Configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS traffic from the EC2 instances.
The correct action is to configure the security group attached to the Interface VPC Endpoint to allow inbound HTTPS traffic from the EC2 instances. Interface VPC Endpoints create Elastic Network Interfaces (ENIs) in the subnet, which are protected by security groups. By default, these security groups may block inbound traffic, so they must be updated to allow traffic on port 443 from the EC2 instances.

Step-by-Step Solution

1
Identify the type of VPC endpoint deployed.
The deployed endpoint is an Interface VPC Endpoint (AWS PrivateLink), which provisions Elastic Network Interfaces (ENIs) inside the subnet.
Understanding the type of endpoint helps determine whether route tables or security groups control traffic access.
2
Evaluate the routing and security group requirements for Interface VPC Endpoints.
Interface VPC Endpoints do not use route table entries. Instead, they rely on security groups to control inbound traffic to the endpoint's ENIs.
Since the endpoint behaves like a network interface inside the VPC, it must allow traffic from the source EC2 instances.
3
Verify and update the security group associated with the Interface VPC Endpoint.
Ensure the inbound rules of the endpoint's security group allow HTTPS (port 443) traffic from the EC2 instances' security group or private IP range.
This allows the EC2 instances to establish the SSL/TLS handshake with the AWS service endpoint via PrivateLink.

Key Concept

Interface VPC Endpoints (AWS PrivateLink) require security group configurations to allow inbound traffic from clients, unlike Gateway Endpoints which rely on subnet route table routes.
Estimated Time:1m 0s
Rate this question

Topics

VPC Endpoints and PrivateLink Integration

More questions from this topic