A SysOps administrator is troubleshooting connectivity for an application hosted on Amazon… — AWS Certified SysOps Administrator - Associate

A SysOps administrator is troubleshooting connectivity for an application hosted on Amazon EC2 instances in a private subnet ( $Subnet\text{-}A$ , CIDR $10.0.1.0/24$ ). The instances need to download packages from the internet and upload large files to an Amazon S3 bucket in the same Region. Currently, the route table for $Subnet\text{-}A$ has a route for $0.0.0.0/0$ pointing to a NAT Gateway in a public subnet. S3 upload traffic is currently routed through the NAT Gateway, incurring high data processing charges. To eliminate these charges, the administrator creates a Gateway VPC endpoint for Amazon S3 but notices that S3 traffic continues to flow through the NAT Gateway. Additionally, a new security policy is applied to the VPC, and the administrator configures a custom network ACL (NACL) for $Subnet\text{-}A$ that allows outbound TCP traffic to ports $80$ and $443$ and inbound TCP traffic on port $22$ for management. Immediately after applying the NACL, the EC2 instances lose all connectivity to both the internet and S3. Which combination of actions will resolve both the routing issue to S3 and the package download issue?

A
Modify the route table for $Subnet\text{-}A$ to replace the NAT Gateway route with a route for $0.0.0.0/0$ targeting an Internet Gateway, and add an inbound rule to the custom NACL allowing TCP traffic from source ports $80$ and $443$ to destination ports $1024\text{-}65535$ .
B
Associate the S3 Gateway VPC endpoint with the route table of $Subnet\text{-}A$ , and add an inbound rule to the custom NACL allowing TCP traffic from source ports $80$ and $443$ to destination ports $80$ and $443$ .
Associate the S3 Gateway VPC endpoint with the route table of $Subnet\text{-}A$ , and add an inbound rule to the custom NACL allowing TCP traffic from source ports $80$ and $443$ to destination ports $1024\text{-}65535$ .Answer
D
Manually add a route in the route table of $Subnet\text{-}A$ with a destination of $0.0.0.0/0$ targeting the S3 Gateway VPC endpoint, and add an inbound rule to the custom NACL allowing TCP traffic from source ports $80$ and $443$ to destination ports $1024\text{-}65535$ .

Answer

Associate the S3 Gateway VPC endpoint with the route table of the private subnet, and add an inbound rule to the custom network ACL allowing TCP traffic from source ports 80 and 443 to destination ports 1024-65535.

The correct action is to associate the S3 Gateway VPC endpoint with the route table of the private subnet and add an inbound rule to the custom network ACL allowing TCP traffic from source ports 80 and 443 to destination ports 1024-65535. Associating the Gateway endpoint dynamically inserts the S3 prefix list route into the route table, routing S3 traffic privately and avoiding NAT Gateway charges. Because network ACLs are stateless, return packets from outbound HTTP/HTTPS and S3 requests will target the client's ephemeral ports (1024-65535) from source ports 80 and 443; hence, they must be allowed explicitly.

Step-by-Step Solution

Analyze the S3 routing issue.

Creating a Gateway VPC endpoint does not automatically redirect traffic unless the endpoint is associated with the subnet's route table. If not associated, traffic destined for S3 will match the default route (

0.0.0.0/0

) pointing to the NAT Gateway, incurring data processing charges.

VPC route tables must contain the specific prefix list route for S3 pointing to the Gateway endpoint (

vpce\text{-}xxxxxx

) to bypass the NAT Gateway.

Analyze the network ACL stateless behavior.

Network ACLs are stateless, meaning return traffic must be explicitly allowed. When the instances initiate outbound requests to download packages (ports

80

and

443

) or connect to S3, the response traffic from the external servers returns to the instances' ephemeral source ports (

1024\text{-}65535

Without an inbound rule allowing response traffic on ephemeral ports, the return packets are dropped, breaking all outward-initiated connections.

Synthesize the resolution steps.

To route S3 traffic privately, associate the S3 Gateway endpoint with the route table of

Subnet\text{-}A

. To fix the stateless NACL block, add an inbound rule allowing TCP traffic from source ports

80

and

443

to destination ports

1024\text{-}65535

These combined actions resolve both the route table configuration issue and the return-traffic NACL block.

Key Concept

Troubleshooting Gateway VPC endpoints and stateless network ACL ephemeral port return traffic rules.

Estimated Time:3m 0s

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic