MENU
A company has deployed Amazon EC2 instances in private subnets in a VPC. The EC2 instances must initiate any requests that leave the VPC, including requests to the company's on-premises data center over an AWS Direct Connect connection. No resources outside the VPC can be allowed to open communications directly to the EC2 instances.
The on-premises data center's customer gateway is configured with a stateful firewall device that filters for incoming and outgoing requests to and from multiple VPCs. In addition, the company wants to use a single IP match rule to allow all the communications from the EC2 instances to its data center from a single IP address.
Which solution will meet these requirements with the LEAST amount of operational overhead?
42 comments · newest first
CH
Chu
11 months ago
B seems like the safest bet for filtering traffic effectively.
VI
Victor
11 months ago
A VPN over Direct Connect sounds solid, but is it really necessary?
SH
Shawn
11 months ago
Wait, why would you use a NAT instance? Isn’t that outdated?
WI
Willodean
12 months ago
I disagree, D could work too, but it’s more manual.
SA
Sage
12 months ago
I think option C is the best choice here. NAT gateway simplifies things.
EM
Emilio
1 year ago
I’m a bit confused about the firewall rules. I think option A could work, but it seems like it might add unnecessary complexity.
HA
Haydee
1 year ago
I feel like deploying a NAT instance could work, but it seems like it might require more management than a NAT gateway. I'm leaning towards option C.
CH
Chandra
1 year ago
I remember practicing a similar question where we had to ensure security while allowing outbound connections. I think option B sounds familiar, but I'm not confident it's the best choice here.
YU
Yuriko
1 year ago
I'm not entirely sure, but I think using a NAT gateway might be the best option since it simplifies outbound traffic management.
CO
Coral
1 year ago
Ah, I recognize this type of question. Piloting a process and implementing feedback sounds like the iterative design approach to me. I'm pretty confident that's the right answer here.
MI
Mickie
1 year ago
Ah, I see. The strategy is to ensure the system interfaces with other systems and networks, so I'll choose option B.
LA
Lavera
1 year ago
Hmm, I'm a bit unsure about this one. I'm trying to decide between options B and C. Creating a separate billing account per project seems like a lot of overhead, but I'm not sure if a single budget for all projects would be the best approach.
KA
Karan
1 year ago
Okay, I think I've got this. The key is remembering that DMR structures should resemble a star schema, with measures and dimensions separated. I'll select the option that reflects that principle.
RI
Rima
1 year ago
I’m leaning towards B; it seems like a safer option to be transparent about confidentiality limitations.
AR
Ariel
1 year ago
Option A? Seriously? Who thought that up, the 'Rube Goldberg Solutions' team?
MA
Margarett
1 year ago
I'm imagining the on-premises network admin seeing this question and just face-palming. 'You want me to do what now?'
PE
Pearlie
1 year ago
C) Deploy a NAT gateway into a private subnet in the VPC where the EC2 instances are deployed. Specify the NAT gateway type as private. Configure the on-premises firewall to allow connections from the IP address that is assigned to the NAT gateway.
JA
Jacki
1 year ago
B) Configure the on-premises firewall to filter all requests from the on-premises network to the EC2 instances. Allow a stateful connection if the EC2 instances in the VPC initiate the traffic.
SH
Shizue
1 year ago
A) Create a VPN connection over the Direct Connect connection by using the on-premises firewall. Use the firewall to block all traffic from on premises to AWS. Allow a stateful connection from the EC2 instances to initiate the requests.
JO
Joanne
1 year ago
As long as the NAT gateway doesn't become a bottleneck, Option C seems like the way to go. It's nice to have a single IP rule to manage on the on-premises firewall.
GA
Garry
1 year ago
Definitely, as long as the NAT gateway can handle the traffic, it should work well.
GA
Gabriele
1 year ago
I think Option C is the most efficient solution with the least operational overhead.
DA
Daniela
1 year ago
Yeah, having a single IP rule on the on-premises firewall simplifies management.
SH
Shayne
1 year ago
I agree, Option C with the NAT gateway seems like the best choice.
LU
Luz
1 year ago
As long as the NAT gateway can handle the traffic, it should work smoothly.
LA
Lashandra
1 year ago
Using a single IP rule for all communications is definitely a plus.
SA
Santos
1 year ago
I think so too. It simplifies the management of the on-premises firewall.
FR
Franchesca
1 year ago
I agree, Option C with the NAT gateway seems like the best choice.
DA
Dahlia
2 years ago
I'm not sure, but option D could also work. Configuring the on-premises firewall to allow connections from the NAT instance might be simpler.
MI
Mica
2 years ago
I'm a bit wary of using a NAT instance instead of a gateway. Instances can be more prone to failure, and the maintenance overhead might be higher. Option C seems cleaner.
JI
Jillian
1 year ago
Yeah, I think option C is the best choice for this scenario.
DE
Denise
1 year ago
I agree, using a NAT gateway would be more reliable and have less maintenance overhead.
PA
Pamela
2 years ago
I agree with Dante. Using a NAT gateway in the VPC seems like the most efficient way to meet the requirements.
DA
Dante
2 years ago
I think option C is the best solution.
RY
Ryan
2 years ago
I'm not sure, but option D also seems like a viable solution. A NAT instance could work well too.
RO
Rolande
2 years ago
I agree with Dominga. Using a NAT gateway in a private subnet seems like the most efficient way to meet the requirements.
DO
Dominga
2 years ago
I think option C is the best solution.
JE
Jerry
2 years ago
Option C looks like the most straightforward solution. Using a private NAT gateway and configuring the on-premises firewall to allow connections from its IP address should do the trick.
LA
Lazaro
1 year ago
Definitely, it's important to minimize operational overhead while maintaining security.
LA
Launa
1 year ago
I think so too. It simplifies the setup and ensures only the necessary connections are allowed.
BU
Buck
1 year ago
I agree, it seems like the most efficient way to meet the requirements.
AM
Amie
1 year ago
Option C looks like the most straightforward solution. Using a private NAT gateway and configuring the on-premises firewall to allow connections from its IP address should do the trick.