Examkin

Soru

Zorluk: Çok zorVPC Endpoints and PrivateLink Integration

An organization hosts a proprietary API service in VPC-B behind an Amazon VPC Network Load Balancer (NLB). A SysOps Administrator in a separate AWS account configures an Interface VPC Endpoint in a private subnet of VPC-A to securely access this API service using AWS PrivateLink. The administrator enables Private DNS on the Interface VPC Endpoint. However, when an application running on Amazon EC2 instances in VPC-A attempts to invoke the API service, the connections consistently fail with a network timeout error. Which TWO configuration steps should the SysOps Administrator perform to troubleshoot and resolve this issue? (Select TWO.)

  1. Verify that the security group associated with the Interface VPC Endpoint allows inbound TCP traffic on the service port from the security group of the EC2 instances in VPC-A.Cevap
  2. Verify that the security group associated with the EC2 instances in VPC-A allows outbound TCP traffic on the service port to the IP addresses or security group of the Interface VPC Endpoint.Cevap
  3. C
    Verify that the route table associated with the private subnet in VPC-A contains a route targeting the Interface VPC Endpoint ID (vpce-xxxxxx) for the API service's traffic.
  4. D
    Verify that the route table associated with the private subnet in VPC-A routes traffic destined for the service provider's CIDR block to a NAT Gateway.
  5. E
    Associate the Interface VPC Endpoint with the route table of the private subnet via the VPC Endpoints console page.

Cevap

Verify that the security group associated with the Interface VPC Endpoint allows inbound TCP traffic from the EC2 instances, and verify that the security group associated with the EC2 instances allows outbound TCP traffic to the Interface VPC Endpoint.
For Interface VPC Endpoints, traffic is directed via DNS to the private IP addresses of the Elastic Network Interfaces (ENIs) deployed in the subnet. Therefore, security groups on both the endpoint network interfaces and the client EC2 instances must explicitly permit the traffic. The security group of the Interface VPC Endpoint must allow inbound traffic from the EC2 instances, and the security group of the EC2 instances must allow outbound traffic to the Interface VPC Endpoint.

Adım Adım Çözüm

1
Analyze the endpoint type and routing mechanism.
Identify that the endpoint is an Interface VPC Endpoint utilizing AWS PrivateLink, which places ENIs directly inside the VPC and uses DNS rather than route table rules.
This rules out adding routes or associating route tables for this endpoint type.
2
Review security group rules for the endpoint network interfaces.
Ensure that the security group attached to the Interface VPC Endpoint allows inbound traffic on the service's port from the client EC2 instances.
Interface endpoints behave like standard network interfaces and are subject to security group evaluation.
3
Review security group rules for the client EC2 instances.
Ensure that the security group attached to the EC2 instances allows outbound traffic on the service's port to the private IP addresses of the endpoint interfaces.
Stateful security groups must permit the initial outbound connection from the client to the endpoint.

Anahtar Kavram

AWS PrivateLink Interface Endpoints require proper security group configurations for inbound and outbound traffic, and do not use route table entries.
Bu soruyu puanla

Konular

VPC Endpoints and PrivateLink Integration

Bu konudan daha fazla soru