A company has deployed Amazon EC2 instances in a private subnet of a VPC. The instances need to write data to Amazon Kinesis Data Streams. To prevent the data from traversing the public internet, a SysOps administrator creates an interface VPC endpoint for Kinesis Data Streams in the VPC and enables the private DNS option. However, the EC2 instances are still unable to connect to the Kinesis service using the default service name kinesis.us-east-1.amazonaws.com. Which of the following configuration changes will resolve this connectivity issue?
- AAdd a route to the private subnet route table with the destination of the Kinesis service pointing to an Internet Gateway.
- BAssociate the interface VPC endpoint with the route table of the private subnet.
- Enable DNS hostnames and DNS resolution attributes for the VPC.Cevap
- DModify the private subnet network ACL outbound rules to allow all ephemeral ports to the Kinesis service range.
Cevap
Enable DNS hostnames and DNS resolution attributes for the VPC.
To resolve the hostnames of interface VPC endpoints using private DNS, the VPC must have both 'enableDnsHostnames' and 'enableDnsSupport' set to true. When these attributes are enabled, the public DNS hostname of the AWS service (such as kinesis.us-east-1.amazonaws.com) resolves to the private IP addresses of the endpoint network interfaces (ENIs) inside the VPC. Without these settings, the hostname resolves to public IP addresses, which are unreachable from a private subnet without internet access.
Adım Adım Çözüm
Anahtar Kavram
Interface VPC Endpoints and Private DNS resolution requirements
Tahmini Süre:1m 30s