Examkin

Soru

Zorluk: OrtaVPC Network Security

A developer is deploying a data processing application on Amazon EC2 instances in private subnets. The application needs to securely access Amazon Kinesis Data Streams to publish streaming data. Corporate security policies dictate that the EC2 instances must not have any route to the public internet, and all AWS API traffic must remain within the AWS network. The solutions architect creates an interface VPC endpoint for Kinesis in the same VPC. Which configuration steps must the solutions architect perform to enable the application to communicate with Kinesis?

  1. Enable Private DNS for the VPC endpoint, and associate a security group with the VPC endpoint that allows inbound HTTPS traffic from the security group of the EC2 instances.Cevap
  2. B
    Add a route in the private subnet route table with the destination pointing to the Kinesis service prefix list and the target as the interface VPC endpoint ID.
  3. C
    Deploy a NAT Gateway in a public subnet, configure the private subnet route table to target the NAT Gateway, and configure a security group to restrict access to Kinesis.
  4. D
    Configure the private subnet's Network ACL to allow outbound traffic to the VPC endpoint, and disable the 'Enable DNS hostnames' setting in the VPC.

Cevap

Enable Private DNS for the VPC endpoint, and associate a security group with the VPC endpoint that allows inbound HTTPS traffic from the security group of the EC2 instances.
The correct option addresses the requirements by enabling Private DNS for the interface VPC endpoint, which ensures Kinesis API requests resolve to the private endpoint ENIs. It also configures the stateful security group on the interface endpoint to allow inbound HTTPS traffic from the EC2 security group, completing the secure private path.

Adım Adım Çözüm

1
Configure DNS settings for PrivateLink
Enabling the Private DNS option ensures that standard Amazon Kinesis endpoint DNS queries resolve to the private IP addresses of the interface endpoint's ENIs within the VPC.
This allows the application to use the default AWS SDK configurations without modifying the API endpoint URL in the code.
2
Configure the VPC Endpoint Security Group
Associate a security group with the interface VPC endpoint and add an inbound rule allowing TCP port 443 (HTTPS) traffic from the security group assigned to the EC2 instances.
Interface endpoints use ENIs which are secured by security groups. Traffic must be allowed inbound to these interfaces.
3
Configure the EC2 Instance Security Group
Ensure the EC2 instances' security group allows outbound TCP port 443 traffic to the VPC endpoint's security group.
Since security groups are stateful, allowing outbound HTTPS traffic from the instances to the endpoint enables the outbound request, and the return traffic is automatically allowed.

Anahtar Kavram

Interface VPC Endpoints (AWS PrivateLink) require Private DNS hostnames and proper Security Group configurations to allow private communication with AWS services without traversing the public internet.
Bu soruyu puanla

Konular

VPC Network Security

Bu konudan daha fazla soru