Examkin

Soru

Zorluk: Çok zorVPC Endpoints and PrivateLink Integration

A company has an on-premises data center connected to an AWS VPC via an AWS Direct Connect connection. A SysOps Administrator needs to enable private access to Amazon S3 for both the on-premises servers and the EC2 instances in a private subnet of the VPC. To minimize data transfer costs, the EC2 instances must use an existing S3 Gateway VPC Endpoint, while the on-premises servers must use a newly created S3 Interface VPC Endpoint.

After deploying the Interface VPC Endpoint for Amazon S3 in the VPC, the administrator notices that the EC2 instances have started routing S3 traffic through the Interface VPC Endpoint, incurring unexpected charges, while the on-premises servers are unable to connect to S3.

Which combination of actions should the SysOps Administrator take to resolve these issues?

  1. A
    Enable Private DNS on the S3 Interface VPC Endpoint. Add a route to the private subnet's Route Table for the Amazon S3 prefix list targeting the Interface VPC Endpoint ID. Ensure the security group attached to the Interface VPC Endpoint allows inbound TCP port 443 traffic from the on-premises network range.
  2. B
    Disable Private DNS on the S3 Interface VPC Endpoint. Add the S3 Interface VPC Endpoint ID to the private subnet's Route Table. Create an inbound rule in the security group of the S3 Gateway VPC Endpoint to allow HTTPS traffic from the on-premises network range.
  3. Disable Private DNS on the S3 Interface VPC Endpoint. Configure the on-premises servers to use the S3 Interface VPC Endpoint's specific DNS names for S3 requests. Update the security group attached to the Interface VPC Endpoint to allow inbound TCP port 443 traffic from the on-premises network range.Cevap
  4. D
    Enable Private DNS on the S3 Interface VPC Endpoint. Remove the S3 Gateway VPC Endpoint route from the private subnet's Route Table to resolve the routing conflict. Configure a Route 53 Resolver inbound endpoint to resolve the public S3 DNS hostname to the Gateway VPC Endpoint.

Cevap

Disable Private DNS on the S3 Interface VPC Endpoint, configure the on-premises servers to use the S3 Interface VPC Endpoint's specific DNS names for S3 requests, and update the security group attached to the Interface VPC Endpoint to allow inbound TCP port 443 traffic from the on-premises network range.
Disabling Private DNS on the S3 Interface VPC Endpoint ensures that the public DNS name for S3 continues to resolve to public IP addresses within the VPC, allowing EC2 instances to utilize the Gateway VPC Endpoint via the subnet's Route Table. On-premises servers must use the endpoint-specific DNS names because the Gateway VPC Endpoint cannot be accessed from on-premises, and disabling Private DNS means standard S3 URLs will not route through the Interface VPC Endpoint automatically. Finally, the Interface VPC Endpoint's security group must permit inbound HTTPS traffic from the on-premises CIDR block to allow successful connection.

Adım Adım Çözüm

1
Disable Private DNS on the S3 Interface VPC Endpoint.
DNS queries for s3.us-east-1.amazonaws.com within the VPC resolve to public S3 IP addresses.
This allows the EC2 instances to match the S3 prefix list route in their subnet Route Table and continue using the Gateway VPC Endpoint, avoiding data processing charges.
2
Configure on-premises applications and servers to use the Interface VPC Endpoint's specific DNS names.
On-premises DNS requests resolve to the private IP addresses of the S3 Interface VPC Endpoint network interfaces.
Since Private DNS is disabled on the Interface VPC Endpoint and Gateway VPC Endpoints are not reachable from on-premises, servers must target the Interface VPC Endpoint explicitly using its unique regional or zonal DNS names.
3
Update the security group of the S3 Interface VPC Endpoint to allow inbound TCP port 443 traffic from the on-premises CIDR block.
The Interface VPC Endpoint permits HTTPS connections originating from the on-premises data center.
By default, Interface VPC Endpoint security groups block inbound traffic unless explicitly permitted, so allowing port 443 from the on-premises range is required for successful connectivity.

Anahtar Kavram

Coexistence of Gateway and Interface VPC Endpoints for S3 to support hybrid architectures while optimizing data transfer costs.
Tahmini Süre:3m 0s
Bu soruyu puanla

Konular

VPC Endpoints and PrivateLink Integration

Bu konudan daha fazla soru