SAP-C02 Question 25
Select 2A company has deployed a multi-tier application in AWS. The application consists of a front-end service running in Amazon ECS (Elastic Container Service) using Fargate, a middle-tier service hosted on an Auto Scaling group of EC2 instances, and a backend database in Amazon RDS. The front-end communicates with the middle-tier via an Application Load Balancer (ALB), and the middle-tier communicates with the database over a private connection. Due to security requirements, all traffic between the front-end and middle-tier, and between the middle-tier and the database, must stay within the AWS network without traversing the public internet. Which combination of solutions will ensure compliance with these requirements?
- A
Place the ECS tasks in a private subnet and configure the ALB to use internal load balancer mode.
- B
Use VPC Peering to connect the front-end ECS tasks and the middle-tier Auto Scaling group.
- C
Create a VPC endpoint for Amazon RDS so the middle-tier instances can communicate with the database over private connections.
- D
Ensure both the ECS tasks and the Auto Scaling group instances share the same VPC and use security groups to control traffic.
- E
Establish a VPN connection between the ECS tasks in Fargate and the middle-tier Auto Scaling group.
Show answer and explanation
Correct answers: A, D
Explanation
To comply with the requirement of keeping traffic entirely within the AWS network, the ECS tasks must be placed in private subnets, and the ALB must be configured as an internal load balancer to ensure secure communication between the front-end and middle-tier. Additionally, placing all resources within the same VPC and using security groups for traffic control ensures that communication remains private and does not traverse the public internet. Solutions like VPC Peering, VPC endpoints for RDS, or VPNs are either unnecessary or irrelevant to this setup.
- A. Correct.
Placing the ECS tasks in a private subnet and configuring the ALB in internal load balancer mode ensures that traffic does not traverse the public internet. This is a valid solution.
- B. Incorrect.
VPC Peering is unnecessary in this scenario because all components (ECS tasks, Auto Scaling group, and RDS) are within the same VPC. VPC Peering is used for connecting different VPCs.
- C. Incorrect.
Amazon RDS does not require a VPC endpoint as it already communicates over the VPC's private network when placed in a private subnet. A VPC endpoint is not relevant here.
- D. Correct.
Ensuring that both ECS tasks and the Auto Scaling group instances operate in the same VPC and use security groups to control traffic ensures secure communication without leaving the AWS network. This is a valid solution.
- E. Incorrect.
A VPN connection is not required for communication within the same VPC. VPNs are used to securely connect on-premises networks to AWS or between separate VPCs.