VPC gateway endpoint vs interface endpoint for S3 and DynamoDB

Try 3 questions on this

Pick an answer to see why each option is right or wrong.

1. An application in a private subnet reads objects from an Amazon S3 bucket in the same Region, and a second workload on premises reads the same bucket across an AWS Direct Connect connection. A solutions architect must keep both paths off the public internet and wants one endpoint that serves both. Cost is a secondary concern. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: A is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   The answerA.Create an interface endpoint for Amazon S3 in the VPC, because an endpoint network interface has a private IP address that the on-premises network can reach.Two of these designs put in-VPC traffic on a private path, and one documented behaviour decides between them. A gateway endpoint is reached by a route in a VPC route table: "When you create a gateway endpoint, you select the VPC route tables for the subnets that you enable"Your answerB.Create a gateway endpoint for Amazon S3 on the private subnet's route table, because gateway endpoints carry no hourly charge for either path.A gateway endpoint would serve the application in the VPC perfectly well and at no charge. It cannot serve the on-premises workload, because it is reached only through a VPC route table and there is no route table on the corporate network.Your answerC.Create a NAT gateway in a public subnet and send both the application traffic and the on-premises traffic through it to Amazon S3.Solves reachability by going out to the public service endpoint, which is what the requirement forbids, and adds per-GB processing charges for both flows.Your answerD.Add a route for the S3 prefix list to the Direct Connect gateway, since a prefix list route reaches the service from any connected network.Treats an AWS-managed prefix list as something a hybrid route can target. The prefix list names the service's public addresses and is used in VPC route tables and security group rules, not as a path over Direct Connect.

   Show the full explanation and doc quotes

   And "all instances in the subnets associated with a route table associated with a gateway endpoint automatically use the gateway endpoint." That is an in-VPC mechanism, and an on-premises host has no VPC route table. An interface endpoint is an elastic network interface with a private IP address in a subnet, which a network connected by AWS Direct Connect can route to, so it is the one endpoint that serves both halves. The cost note in the stem is the qualifier that makes the cheaper option tempting rather than correct.

   Written from docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html

2. A VPC has a gateway endpoint for Amazon S3 associated with the route table used by two of its six private subnets. An audit shows that instances in the other four subnets still reach S3 over the public service endpoint through a NAT gateway, and all six subnets must use the gateway endpoint. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: B is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Create a gateway endpoint in each of the remaining four subnets, because a gateway endpoint serves the subnet it is created in.A gateway endpoint is not created in a subnet. It is associated with route tables, and one endpoint serves every subnet whose route table is associated.The answerB.Associate the remaining subnets' route tables with the gateway endpoint, which adds the endpoint route to each.A gateway endpoint reaches exactly the subnets whose route tables carry its route. "When you create a gateway endpoint, you select the VPC route tables for the subnets that you enable", and the consequence is stated plainly: "All instances in the subnets associated with a route table associated with a gateway endpoint automatically use the gateway endpoint to access the service. Instances in subnets that aren't associated with these route tables use the public service endpoint, not the gateway endpoint." The four subnets are not misconfigured in any other way; their route tables were simply never associated. Associating them adds the endpoint route automatically, and no charge follows, since "there is no additional charge for using gateway endpoints".Your answerC.Remove the NAT gateway, because instances fall back to the gateway endpoint when no other route to the service exists.Breaks every other outbound flow those subnets have, to fix routing for one service.Your answerD.Attach an endpoint policy that denies requests arriving over the public service endpoint, so that those subnets are forced to the endpoint.An endpoint policy governs requests that arrive through the endpoint. It cannot see traffic that took the public path.

   Written from docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html

3. A team creates a gateway endpoint for Amazon S3 and associates the right route table. The instances run under a security group whose outbound rules list only a database port and the corporate proxy. S3 calls from those instances now time out, and the security group must not be opened to all destinations. Which approach will meet these requirements?

   Right. In the game that’s Renown for your Design Secure Architectures building.

   Not that one: D is right. In the game your Design Secure Architectures building would lose a little Renown, and this question would come back later.

   Your answerA.Add the service's prefix list to the subnet's network ACL as an outbound rule, which is where endpoint traffic is filtered."You can't reference prefix lists in network ACL rules", though the IP ranges from the prefix list can be used there.Your answerB.Add an outbound rule to the security group for TCP 443 with the gateway endpoint's ID as the destination.A security group rule takes a CIDR block, a prefix list or another security group. An endpoint ID is not a destination.Your answerC.Add an outbound rule allowing TCP 443 to 0.0.0.0/0, because the endpoint route keeps the traffic inside AWS anyway.Opens every destination on 443, which the requirement forbids, and is unnecessary when a prefix list exists.The answerD.Add an outbound rule to the security group for TCP 443 with the service's prefix list as the destination.Traffic through a gateway endpoint is still traffic to the service's public IP ranges, so the security group has to allow it. "When your instances access Amazon S3 or DynamoDB through a gateway endpoint, they access the service using its public endpoint. The security groups for these instances must allow traffic to and from the service", and the documented rule is precisely the one in this option: destination the service's prefix list, protocol TCP, port 443. The prefix list is what keeps the rule narrow, which is what the requirement asks for.

   Written from docs.aws.amazon.com/vpc/latest/privatelink/gateway-endpoints.html