DEA-C01 Question 427
Select 2You are designing a secure data engineering pipeline in AWS. Your architecture includes an Amazon Redshift cluster within a VPC. To ensure the cluster is only accessible from a specific Amazon EC2 instance in the same VPC, which of the following actions should you take? (Select TWO)
- A
Create a security group for the Redshift cluster with an inbound rule allowing traffic only from the EC2 instance's security group.
- B
Create a Network ACL that denies all inbound traffic to the Redshift cluster except from the EC2 instance's private IP address.
- C
Ensure both the EC2 instance and the Redshift cluster are in the same subnet within the VPC.
- D
Attach an Elastic IP to the Redshift cluster and configure the EC2 instance to access it using the Elastic IP.
- E
Set up a VPC endpoint to allow private communication between the EC2 instance and the Redshift cluster.
Show answer and explanation
Correct answers: A, B
Explanation
To securely allow an Amazon Redshift cluster to be accessed only by a specific EC2 instance within the same VPC, you should use a combination of security groups and Network ACLs. Security groups are stateful and allow fine-grained control over which resources can access the cluster. Network ACLs, on the other hand, provide stateless subnet-level access control, adding an additional layer of security. Together, they ensure that only the designated EC2 instance can access the Redshift cluster.
- A. Correct.
Correct: Security groups allow you to define inbound rules to restrict access based on source, such as another security group. By allowing traffic only from the EC2 instance's security group, you ensure secure communication.
- B. Correct.
Correct: Network ACLs provide an additional layer of security at the subnet level. By configuring a rule to allow traffic only from the EC2 instance’s private IP address, you can restrict access to the Redshift cluster.
- C. Incorrect.
Incorrect: While being in the same subnet can reduce network latency, it's not strictly required for secure communication within a VPC. Security groups and Network ACLs enforce access control.
- D. Incorrect.
Incorrect: Assigning an Elastic IP to the Redshift cluster would make it publicly accessible, which violates the principle of least privilege and is unnecessary when both resources are within the same VPC.
- E. Incorrect.
Incorrect: VPC endpoints are used to privately connect to AWS services like S3 or DynamoDB, not for communication between resources in the same VPC.