An organization is deploying an auditing application on Amazon ECS tasks running on AWS Fa… — AWS Certified Solutions Architect - Associate

An organization is deploying an auditing application on Amazon ECS tasks running on AWS Fargate. The Fargate tasks are located in private subnets with a CIDR block of $172.16.10.0/24$ within a VPC. The tasks must access an Amazon Aurora PostgreSQL database in a dedicated database subnet with a CIDR block of $172.16.20.0/24$ , download compliance data securely from Amazon S3, and occasionally connect to an external auditing API hosted on the public internet.

To align with security policies:
1. Data transfers to Amazon S3 must remain within the AWS network and must not incur data processing charges.
2. Direct outbound internet access is prohibited; instead, internet traffic must go through NAT Gateways located in public subnets.
3. Network Access Control Lists (Network ACLs) on the Fargate private subnets must implement a least-privilege configuration.

Which combination of configurations will meet these requirements? (Select TWO.)

Create an Amazon S3 Gateway VPC Endpoint and associate it with the Fargate private subnet route tables. Add a route for $0.0.0.0/0$ pointing to the NAT Gateways in the public subnets.Cevap
In the Fargate subnet Network ACL, configure an outbound rule allowing traffic to $0.0.0.0/0$ on TCP port $443$ , and an inbound rule allowing traffic from $0.0.0.0/0$ on TCP ports $1024-65535$ .Cevap
C
Create an Amazon S3 Interface VPC Endpoint in the Fargate subnets, and configure the Fargate subnet route table to target the endpoint's elastic network interfaces for all S3 traffic.
D
In the Fargate subnet Network ACL, configure an outbound rule allowing TCP port $443$ with a destination of the Amazon S3 prefix list.
E
In the Fargate Security Group, configure an inbound rule allowing TCP port $443$ from the NAT Gateway public IP addresses to permit return traffic from the external compliance API.

Cevap

To meet the requirements, the solutions architect should create an Amazon S3 Gateway VPC Endpoint and associate it with the Fargate private subnet route tables, routing other internet traffic to the NAT Gateways. Additionally, the Fargate subnet Network ACL must be configured to allow outbound traffic to all destinations on TCP port

443

and inbound return traffic from all destinations on TCP ports

1024-65535

Creating a Gateway VPC Endpoint for S3 and associating it with the Fargate private subnet route tables ensures that S3 data transfer is routed within the AWS network without incurring data processing fees. The route table also successfully routes all other external internet traffic to the NAT Gateways via the default route. Because Network ACLs are stateless, they require both an outbound rule (allowing HTTPS traffic on port

443

to establish the connection) and an inbound rule (allowing response traffic on ephemeral ports

1024-65535

from the destination) to work correctly.

Adım Adım Çözüm

Select the correct endpoint type for Amazon S3.

Identify that Gateway VPC Endpoints are free of data processing charges, whereas Interface VPC Endpoints (PrivateLink) incur both hourly and data processing charges.

This fulfills the cost requirement that S3 transfers must not incur data processing charges.

Configure the route table for the Fargate subnets.

Associate the Gateway VPC Endpoint with the private subnet route tables (which adds the S3 prefix list route) and configure a default route (

0.0.0.0/0

) pointing to the NAT Gateways in the public subnets.

This establishes path-routing for S3 traffic directly to the endpoint and external internet traffic to the NAT Gateways.

Design stateless Network ACL rules for Fargate tasks.

Allow outbound HTTPS traffic (port

443

) to

0.0.0.0/0

to cover both S3 and the external compliance API, and allow inbound traffic from

0.0.0.0/0

on ephemeral ports (

1024-65535

) to allow return packets.

Because Network ACLs are stateless, return traffic must be explicitly allowed. Since S3 and the external API use public IP addresses,

0.0.0.0/0

must be used (especially because Network ACLs do not support prefix lists).

Anahtar Kavram

VPC Network Security using NAT Gateways, Gateway VPC Endpoints, stateful Security Groups, and stateless Network ACLs.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru