A SysOps Administrator is troubleshooting a connectivity issue where Amazon EC2 instances in a private subnet cannot access Amazon S3. The administrator has created a Gateway VPC Endpoint for Amazon S3 in the VPC. However, when inspecting the VPC Flow Logs, the administrator notices that S3 traffic from the instances is still being routed through a NAT gateway in a public subnet, resulting in unexpected data transfer charges. The private subnet's route table contains a default route () targeting the NAT gateway. How should the administrator resolve this routing issue to ensure S3 traffic uses the Gateway VPC Endpoint?
- AEnable route propagation on the S3 Gateway VPC Endpoint to automatically inject the S3 routing prefix list into the private subnet's route table.
- BChange the target of the default route () in the private subnet's route table to point directly to the Internet Gateway.
- Associate the S3 Gateway VPC Endpoint with the route table of the private subnet.Cevap
- DModify the private subnet's Network ACL to allow outbound ephemeral port traffic to the S3 IP address range.
Cevap
Associate the S3 Gateway VPC Endpoint with the route table of the private subnet.
Associating the S3 Gateway VPC Endpoint with the private subnet's route table adds a specific route for the S3 prefix list targeting the endpoint. Because prefix list routes are more specific than a default route (), S3-bound traffic will bypass the NAT gateway and route through the private endpoint.
Adım Adım Çözüm
Anahtar Kavram
Gateway VPC Endpoints require manual route table association to redirect traffic from default routes.
Tahmini Süre:1m 30s