An application runs on Amazon EC2 instances in private subnets across two Availability Zon… — AWS Certified SysOps Administrator - Associate

An application runs on Amazon EC2 instances in private subnets across two Availability Zones (`us-east-1a` and `us-east-1b`) in a VPC. The instances continuously ingest sensor data and send it to an Amazon Kinesis data stream in the same region, transferring approximately $10\text{ TB}$ of data monthly. Currently, all internet-bound traffic from these subnets routes through a single NAT Gateway located in `us-east-1a`. The monthly AWS bill shows high NAT Gateway data processing charges. Which solution will minimize the data transfer and processing costs while maintaining secure, private connectivity to the Kinesis data stream?

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon Kinesis in both Availability Zones, and enable Private DNS for the endpoint.Cevap
B
Create a Gateway VPC Endpoint for Amazon Kinesis, and associate it with the route tables of the private subnets in both Availability Zones.
C
Deploy a second NAT Gateway in `us-east-1b`, and update the route table for the subnet in `us-east-1b` to route traffic through the new NAT Gateway.
D
Associate an Internet Gateway with the VPC, assign public IP addresses to the EC2 instances, and update the route tables to route Kinesis traffic directly to the Internet Gateway.

Cevap

Create an Interface VPC Endpoint (AWS PrivateLink) for Amazon Kinesis in both Availability Zones, and enable Private DNS for the endpoint.

The correct solution is to use Interface VPC Endpoints (AWS PrivateLink) for Amazon Kinesis with Private DNS enabled. Interface VPC Endpoints route traffic privately over the AWS backbone network, bypassing the NAT Gateway entirely. The data processing rate for Interface VPC Endpoints is

\$0.01\text{ per GB}

, which is much lower than the NAT Gateway processing fee of

\$0.045\text{ per GB}

. In addition, placing an interface endpoint in each Availability Zone eliminates cross-AZ data transfer fees. Enabling Private DNS ensures that the application can query Kinesis using its standard DNS names without code modifications.

Adım Adım Çözüm

Analyze current costs

Current NAT Gateway processing cost is

10,000\text{ GB} \times \$0.045\text{/GB} = \$450\text{/month}

plus cross-AZ data transfer charges for the instances in `us-east-1b` routing to `us-east-1a` (

5,000\text{ GB} \times \$0.01\text{/GB} = \$50\text{/month}

) and the NAT Gateway hourly charge (

\,\sim\!\!\$32.85\text{/month}

), totaling approximately

\$532.85\text{/month}

Establishing a baseline cost helps evaluate the savings of alternative routing configurations.

Identify the endpoint type supported by Amazon Kinesis Data Streams

Kinesis Data Streams supports Interface VPC Endpoints (AWS PrivateLink), which cost

\$0.014\text{ per hour}

per endpoint and

\$0.01\text{ per GB}

for data processing.

Gateway VPC Endpoints are free but are only supported by S3 and DynamoDB; other services require Interface VPC Endpoints.

Calculate the Interface VPC Endpoint solution costs

Deploying Interface Endpoints in two Availability Zones costs

2 \times \$0.014\text{/hour} \times 730\text{ hours} = \$20.44\text{/month}

plus data processing costs of

10,000\text{ GB} \times \$0.01\text{/GB} = \$100\text{/month}

, totaling

\$120.44\text{/month}

Comparing the new cost of

\$120.44\text{/month}

to the current cost of

\$532.85\text{/month}

shows savings of over

\$400\text{/month}

Configure the Interface VPC Endpoint settings

Enable Private DNS to map the default public Kinesis DNS hostnames to the private IP addresses of the endpoint network interfaces.

This allows the application on the EC2 instances to continue writing to Kinesis without code modifications or route table updates.

Anahtar Kavram

Using Interface VPC Endpoints (AWS PrivateLink) to optimize data transfer costs by bypassing NAT Gateways for internal AWS service traffic.

Soru

Cevap

Adım Adım Çözüm

Anahtar Kavram

Sık Yapılan Hatalar

Konular

Bu konudan daha fazla soru