A development team has configured a VPC peering connection (`pcx-0a1b2c3d4e5f6g7h8`) betwe… — AWS Certified SysOps Administrator - Associate

A development team has configured a VPC peering connection (`pcx-0a1b2c3d4e5f6g7h8`) between a database VPC (CIDR $172.31.0.0/16$ ) and an application VPC (CIDR $10.100.0.0/16$ ). An application server with IP address $10.100.1.45$ in Subnet App-1 is unable to connect to a PostgreSQL database instance with IP address $172.31.10.12$ in Subnet DB-1. The database security group has been configured to allow incoming traffic on port $5432$ from $10.100.1.45/32$ . The network ACLs for both subnets are configured with their default settings.

Which actions must be completed to enable successful communication between the application server and the database instance? (Select TWO.)

Add a route to the route table associated with Subnet App-1 that routes traffic for $172.31.0.0/16$ through `pcx-0a1b2c3d4e5f6g7h8`.Answer
Add a route to the route table associated with Subnet DB-1 that routes traffic for $10.100.0.0/16$ through `pcx-0a1b2c3d4e5f6g7h8`.Answer
C
Configure an Internet Gateway in both VPCs and add routes pointing to the Internet Gateway for the peer VPC CIDR ranges.
D
Add an outbound rule to the Network ACL of Subnet DB-1 to allow traffic to ephemeral ports ( $1024-65535$ ) for the application subnet.
E
Enable DNS resolution support for the VPC peering connection on both the requester and accepter VPCs.

Answer

Add a route to the route table associated with Subnet App-1 that routes traffic for

172.31.0.0/16

through the peering connection, and add a route to the route table associated with Subnet DB-1 that routes traffic for

10.100.0.0/16

through the peering connection.

For communication to succeed across a VPC peering connection, bidirectional route table entries must exist. The route table for the application subnet must route database traffic (

172.31.0.0/16

) to the peering connection, and the route table for the database subnet must route return traffic (

10.100.0.0/16

) back to the peering connection. Since security groups and default Network ACLs are already configured correctly, establishing these routes will resolve the connection timeout.

Step-by-Step Solution

Examine the network flow and routing tables of both subnets.

Confirm that traffic destined for the peered VPC needs explicit routing entries in both route tables.

VPC Peering does not automatically update subnet route tables; they must be manually updated to point to the peering connection ID.

Verify security groups and Network ACLs configuration.

The security group allows incoming port

5432

from the application server's IP address. Default Network ACLs allow all inbound and outbound traffic.

Ensures that packet filters are already open and routing is the remaining bottleneck.

Add bidirectional routes to the VPC peering connection.

Add a route in Subnet App-1's route table pointing to

172.31.0.0/16

via the peering ID, and add a route in Subnet DB-1's route table pointing to

10.100.0.0/16

via the peering ID.

This establishes a bidirectional path allowing the application server to reach the database and the database to send return packets back to the application server.

Key Concept

VPC Peering Bidirectional Routing

Question

Answer

Step-by-Step Solution

Key Concept

Common Mistakes

Topics

More questions from this topic