ANS-C01 Question 432
Select 2An organization has implemented a distributed application hosted across multiple AWS accounts, using a shared VPC to centralize network resources. The organization wants to ensure that only specific EC2 instances in the shared VPC can communicate with each other, while adhering to least privilege principles. What is the MOST appropriate solution to achieve this?
- A
Leverage security groups with rules to explicitly allow communication between the EC2 instances within the shared VPC.
- B
Use Network ACLs to deny all inbound and outbound traffic by default, then whitelist specific instance IP addresses for communication.
- C
Implement AWS Network Firewall in the shared VPC to create stateful rules allowing communication between specific instances.
- D
Attach IAM policies to the EC2 instances to control network traffic between them.
- E
Use VPC Flow Logs to monitor traffic and then manually intervene to block unauthorized communications.
Show answer and explanation
Correct answers: A, C
Explanation
To enforce least privilege and allow communication only between specific EC2 instances in a shared VPC, the best solutions are to use security groups with explicit rules and AWS Network Firewall for centralized control. Security groups provide instance-level granularity and stateful filtering, while AWS Network Firewall offers centralized traffic management and additional layer 7 filtering capabilities. Network ACLs, IAM policies, and VPC Flow Logs are either less effective or inappropriate for this use case.
- A. Correct.
Correct. Security groups are stateful and can be configured to explicitly allow communication between specific instances, providing a fine-grained level of control over traffic within the shared VPC.
- B. Incorrect.
Incorrect. While Network ACLs can be used to control traffic, they are stateless and operate at the subnet level, which makes them less granular and less effective for controlling instance-to-instance communication.
- C. Correct.
Correct. AWS Network Firewall provides a centralized method to enforce stateful rules, allowing you to permit traffic only between specific instances, while adhering to least privilege principles.
- D. Incorrect.
Incorrect. IAM policies are designed to manage permissions for AWS API actions, not for controlling instance-to-instance network traffic. They cannot be used to filter network communication.
- E. Incorrect.
Incorrect. VPC Flow Logs are used for monitoring traffic and troubleshooting; they are not a mechanism for controlling or blocking network traffic.