Purpose of This Lesson

This lesson focuses on recognizing common Amazon VPC troubleshooting and architecture scenarios for the AWS Certified CloudOps Engineer Associate (SOA-C03). The key decisions involve selecting the correct VPC component, checking routing and state, and distinguishing between security groups, network ACLs, gateways, endpoints, and VPN connectivity.

Key Concepts

• NAT gateways allow resources in private subnets to initiate connections to external services without requiring public IP addresses. A NAT gateway is highly available within a single Availability Zone, not across Availability Zones.
• VPC flow logs capture traffic information that can help diagnose connectivity problems and identify traffic sources. For NAT traffic analysis, logs can be collected from the NAT gateway’s elastic network interface and queried with CloudWatch Logs Insights using source IP addresses.
• VPC endpoints provide private connectivity to supported AWS services such as Amazon S3. They can avoid public IP addressing and public internet paths.
• Internet gateways provide the VPC-side connection required for internet connectivity. The relevant subnet route table must also contain a route pointing to the internet gateway.
• Virtual private gateways (VGWs) support AWS Site-to-Site VPN connectivity from a VPC to an office or on-premises network.
• VPC peering connects two VPCs, including VPCs in different AWS Regions. Peering does not automatically update route tables or security controls.
• Security groups control allowed traffic for associated network interfaces. A missing inbound rule can prevent SSH or ICMP access.
• Network ACLs apply at the subnet level and can explicitly allow or deny traffic. They are useful for blocking a malicious IP across all affected subnet traffic, including ingress and egress.

VPC Connectivity and Troubleshooting Context

Finding the Instances Using a NAT Gateway Most Heavily

To identify instances generating the most traffic through a NAT gateway:

1. Enable or inspect VPC flow logs for the NAT gateway’s elastic network interface.
2. Send the logs to CloudWatch Logs.
3. Use CloudWatch Logs Insights to filter and aggregate records by source IP address.
4. Map the source addresses back to the private instances generating the traffic.

The important clue is that the NAT gateway’s network interface is the traffic observation point.

NAT Gateway Availability and Failure States

A NAT gateway provides high availability within its own Availability Zone, but it is not automatically highly available across Availability Zones. For resilient multi-AZ designs, use multiple NAT gateways and route traffic appropriately for the Availability Zones involved.

If a private subnet route table shows a NAT gateway target with a black hole status, the referenced NAT gateway has been deleted. The route exists, but it cannot forward traffic. Correct the route by replacing the deleted target with a valid NAT gateway or otherwise updating the routing design.

Private Access to Amazon S3

When instances need to access S3 without public IP addresses, use a NAT gateway or a VPC endpoint. If the requirement is private network connectivity specifically, a VPC endpoint is the direct choice.

To restrict access so that only traffic arriving through the intended VPC endpoint can use the bucket, combine:

• A VPC endpoint for S3
• An S3 bucket policy whose condition limits S3 actions based on the VPC endpoint as the source

Permissions alone are not sufficient for endpoint connectivity. The relevant subnet route table must include the endpoint as a target, or the endpoint must otherwise be associated with the route table used by the subnet. If that routing relationship is missing, instances may still be unable to reach S3 even when permissions appear correct.

Internet Connectivity Through an Internet Gateway

For EC2 instances to have inbound and outbound internet connectivity:

1. Attach an internet gateway to the VPC.
2. Add a subnet route-table entry pointing internet-bound traffic to the internet gateway.
3. Ensure the instance addressing and security controls support the required traffic.

A public IP on an instance behind an Application Load Balancer does not by itself fix all external connectivity problems. The VPC must have an attached internet gateway and the applicable route table must direct internet traffic to it.

Private Administration from an Office

To manage EC2 instances in private subnets from an office without giving the instances internet access, use a virtual private gateway and an AWS VPN connection to the company office. Configure the required routing in the VPC so that office traffic reaches the private subnet and return traffic can reach the office network.

For hybrid requirements involving encryption:

• Use AWS VPN for encryption in transit.
• Use AWS Key Management Service (KMS) keys for encryption at rest.

These address different protection requirements and should not be treated as interchangeable.

Diagnosing Application and Database Connectivity

When a network change causes an application-to-database connection problem, VPC flow logs can help determine what happened to the traffic. Review both inbound and outbound records and look for accepted or rejected traffic between the relevant network interfaces. Flow logs provide evidence about traffic handling and can help identify whether the problem is related to network controls or routing.

VPC Peering Between Private Subnets

VPC peering does not automatically make private instances communicate. For connectivity between private subnets in peered VPCs:

• Update the route table in each VPC with a route to the other VPC’s address range.
• Check security groups on the communicating instances.
• Verify that the required traffic is allowed in both directions where applicable.

The route target for each route must point to the VPC peering connection. A peering connection can also be used between VPCs in different Regions. In the described cross-Region backup scenario, inter-Region VPC peering provides private connectivity and encrypts data across the AWS global network.

Network ACLs, Security Groups, and ICMP

Use a network ACL when a malicious IP address must be blocked for all ingress and egress traffic affecting a subnet. Add a deny rule for the address in the network ACL associated with the affected subnet or subnets.

Network ACLs are also a likely cause when VPC flow logs show inbound traffic accepted but outbound traffic rejected during a VPN-based ping from on premises. Modify the network ACL to allow the required traffic in both directions.

Security groups are a common explanation for successful SSH but failed ping. If an administrator can SSH to an instance from the internet but cannot ping it, check whether the instance’s security group allows ICMP. SSH and ICMP require separate security-group rules.

Likewise, if SSH succeeds from an office but times out when the administrator works from home, verify that the home network’s source IP range is included in the security group’s inbound SSH allow rule. The rule that permits the office does not automatically permit a different source network.

Exam- or Assessment-Relevant Takeaways

• A NAT gateway is AZ-scoped for availability; use multiple NAT gateways for cross-AZ resilience.
• A black-hole NAT route usually means the NAT gateway target was deleted.
• For private S3 access, distinguish between using a NAT gateway and using a VPC endpoint; use the endpoint when private endpoint-based access is required.
• A VPC endpoint setup still depends on the subnet’s route-table relationship.
• Internet access requires both an attached internet gateway and a suitable route-table entry.
• VPC peering requires routes in the participating VPCs and compatible security-group rules.
• Use AWS VPN for encrypted traffic in transit and KMS keys for encryption at rest.
• Use network ACLs for subnet-level explicit blocking, especially when a malicious IP must be denied for ingress and egress.
• Use security-group rules to allow the required protocols and source ranges, including separate consideration for SSH and ICMP.
• VPC flow logs are a diagnostic source for identifying accepted and rejected traffic and for tracing NAT traffic to source IPs.

Tool / Feature Decision Guide

Requirement or symptom	Best-fit feature or check	Decisive reason
Identify private instances generating heavy NAT traffic	VPC flow logs on the NAT gateway ENI plus CloudWatch Logs Insights	Enables filtering by source IP address
Make NAT service resilient across Availability Zones	Multiple NAT gateways with appropriate routing	A single NAT gateway is not cross-AZ highly available
Reach S3 without public IP addresses	VPC endpoint or NAT gateway	A VPC endpoint provides private endpoint-based access; NAT provides outbound translation
Restrict S3 access to a specific endpoint	S3 bucket policy conditioned on the VPC endpoint	Limits the permitted source path
Private EC2 administration from an office	VGW and AWS VPN with VPC routing	Connects the office to private subnets without internet access for the instances
Encrypt hybrid traffic in transit	AWS VPN	Provides encrypted network connectivity
Encrypt data at rest	KMS keys	Addresses storage/data-at-rest encryption
Provide VPC internet connectivity	Internet gateway plus subnet route	Both attachment and routing are required
Connect private subnets in peered VPCs	Routes to the peer CIDR ranges plus security-group checks	Peering alone does not install routes or allow traffic
Block one malicious IP across subnet traffic	Network ACL deny rule	Applies at the subnet boundary and can deny ingress and egress
Permit a new administrator’s SSH source	Security-group inbound SSH rule for the new source range	Security groups must allow the actual client source
Permit ping after SSH already works	Security-group ICMP rule	SSH permission does not imply ICMP permission

Common Traps / Misconceptions

• Assuming a NAT gateway is automatically multi-AZ: Its availability scope is its own Availability Zone. Cross-AZ resilience requires multiple NAT gateways.
• Treating a black-hole route as a transient connectivity issue: It indicates that the referenced NAT gateway has been deleted.
• Assuming an S3 endpoint works solely because IAM or bucket permissions are correct: The subnet must have the required route-table association or endpoint target.
• Assuming VPC peering automatically enables communication: Both sides need routes, and security groups must permit the traffic.
• Confusing an internet gateway with a complete internet configuration: The gateway must be attached and referenced by the subnet route table.
• Using security groups for every subnet-wide block: A network ACL is the appropriate control when a malicious IP must be denied across affected subnet ingress and egress.
• Assuming successful SSH proves ping should work: ICMP requires its own security-group allowance.
• Forgetting source-IP scope: An office SSH rule may not permit the administrator’s home network.
• Confusing encryption in transit with encryption at rest: AWS VPN and KMS address different parts of the data-protection requirement.

Real-World Engineer / Analyst Notes

• Start VPC troubleshooting by tracing the complete path: source subnet, route table, gateway or endpoint, destination, and return path.
• When reviewing flow logs, examine both directions. An accepted inbound record paired with a rejected outbound record strongly suggests a control or routing problem on the return path.
• Record the actual client source range when changing SSH rules. Moving from an office to a home network changes the source address even when the destination instance is unchanged.
• For endpoint-based S3 access, validate routing and the bucket policy together; either one can prevent the intended access pattern.
• When using network ACLs, remember that broad deny rules can affect more traffic than the specific application flow being investigated. Apply the rule to the correct subnet scope and verify both directions.

Quick Reference Summary

• NAT traffic investigation: VPC flow logs on the NAT gateway ENI → CloudWatch Logs Insights → filter by source IP.
• NAT availability: One NAT gateway is AZ-local; use multiple gateways for multi-AZ resilience.
• Black-hole route: The referenced NAT gateway has been deleted.
• Private S3 access: Use a VPC endpoint and ensure the subnet route table targets or associates with it.
• S3 restriction: Use an S3 bucket policy conditioned on the VPC endpoint.
• Internet access: Attach an internet gateway and add a route from the subnet route table.
• Private office administration: VGW + AWS VPN + correct VPC and return routes.
• Cross-VPC communication: Peering connection + routes to the peer CIDR + permitted security groups.
• Subnet-wide malicious-IP block: Network ACL deny rule.
• SSH versus ping: SSH needs an SSH rule; ping needs ICMP permission.
• Changing client location: Add the new source IP range to the security-group allow rule.

Flashcards

Q: A team needs to identify which private EC2 instances generate the most traffic through a NAT gateway. Which telemetry and query approach should it use?

A: Use VPC flow logs for the NAT gateway’s elastic network interface and query them with CloudWatch Logs Insights, filtering or aggregating by source IP address.

Q: What does a black-hole NAT gateway target in a private subnet route table indicate?

A: The route references a NAT gateway that has been deleted. The route must be updated to use a valid target.

Q: A design needs NAT connectivity that remains available if one Availability Zone fails. What should be changed?

A: Deploy multiple NAT gateways, typically with routing designed for the relevant Availability Zones, because one NAT gateway is not highly available across AZs.

Q: When should a VPC endpoint be preferred over a NAT gateway for S3 access?

A: Prefer the VPC endpoint when instances must reach S3 through private network connectivity rather than through a NAT-based outbound path.

Q: Instances have S3 permissions and an endpoint exists, but they cannot connect. What routing detail should be checked first?

A: Confirm that the subnet’s route table is associated with the endpoint or contains the endpoint as the required target.

Q: How can S3 access be restricted so that requests must originate through a particular VPC endpoint?

A: Add an S3 bucket-policy condition that limits the allowed S3 actions based on the VPC endpoint as the source.

Q: What two configuration elements are required for EC2 internet connectivity through an internet gateway?

A: The internet gateway must be attached to the VPC, and the applicable subnet route table must contain a route pointing internet traffic to it.

Q: An office must SSH to EC2 instances in private subnets, and the instances must not have internet access. Which connectivity design fits?

A: Use a virtual private gateway with an AWS VPN connection to the office and configure the necessary VPC and return routes.

Q: How do AWS VPN and KMS differ in the hybrid encryption scenario?

A: AWS VPN provides encryption in transit between networks, while KMS keys are used for encryption at rest.

Q: Two VPCs are peered, but private instances cannot communicate. What two categories of configuration should be checked?

A: Check route tables for routes to the other VPC’s address range and check security groups for rules allowing the required traffic.

Q: A malicious IP must be blocked from all ingress and egress traffic for affected subnets. Which control is the appropriate choice?

A: Add a deny rule for that IP address to the relevant network ACLs, because network ACLs operate at the subnet level.

Q: VPC flow logs show inbound traffic accepted but outbound traffic rejected during an on-premises ping. What is a likely cause?

A: A network ACL may be rejecting the return traffic. Modify the ACL to allow the required flow in both directions.

Q: SSH works to an instance, but ping fails. What common security-group issue explains this behavior?

A: The security group allows SSH but does not allow ICMP. SSH and ping require separate protocol permissions.

Q: Why might SSH work from an office but time out from the administrator’s home network?

A: The security group may allow the office IP range but not the home’s source IP range. Add an appropriate inbound SSH rule for the home network if permitted.

Practice Questions

Question 1

A private EC2 instance cannot reach S3. A VPC endpoint exists, the bucket policy and instance permissions appear correct, and the instance has no public IP. Which check is most likely to reveal the problem?

A. Whether the instance has an inbound ICMP rule
B. Whether the subnet route table uses or is associated with the S3 endpoint
C. Whether an internet gateway has a public DNS name
D. Whether the VPC has a second security group

Correct answer: B

Explanation: The scenario specifically describes an endpoint-based private path. The subnet’s route-table relationship with the endpoint must be present; permissions alone do not provide network reachability.

Question 2

A private subnet route table contains a NAT gateway route, but the target status is black hole. Private instances have lost outbound connectivity. What is the best corrective action?

A. Add an ICMP rule to the instance security group
B. Replace the route target with a valid NAT gateway
C. Add a VPC peering route to the public internet
D. Remove all network ACL rules

Correct answer: B

Explanation: A black-hole NAT route indicates that the referenced NAT gateway was deleted. The route must point to a valid NAT gateway or be redesigned.

Question 3

A company has peered two VPCs. Instances in private subnets still cannot connect across the peering connection. Which configuration provides the required connectivity?

A. Add routes to the other VPC’s CIDR range and allow the traffic in security groups
B. Attach an internet gateway to both VPCs only
C. Add public IP addresses to all instances and remove private routes
D. Create a new S3 endpoint in each VPC

Correct answer: A

Explanation: VPC peering does not automatically update route tables or security groups. Both the destination routes and traffic permissions must support the connection.

Question 4

An administrator can SSH to an EC2 instance from the company office but receives a timeout when working from home. The instance is otherwise available. What is the most likely cause?

A. The NAT gateway is not multi-AZ
B. The home network’s source IP range is missing from the inbound SSH security-group rule
C. The instance requires an S3 VPC endpoint
D. The VPC peering connection is encrypted incorrectly

Correct answer: B

Explanation: Security-group rules evaluate the source of the connection. An allow rule for the office range does not automatically allow a different home source range.

Question 5

A security team identifies one malicious IP and requires it to be blocked for ingress and egress traffic across the web-server subnets. Which control best matches the requirement?

A. An S3 bucket policy
B. A security-group outbound rule on one instance
C. A network ACL deny rule on the affected subnets
D. A route to an internet gateway

Correct answer: C

Explanation: Network ACLs operate at the subnet level and can explicitly deny traffic for the specified IP address in the required directions.

WordPress Metadata

Suggested Slug:
amazon-vpc-exam-scenarios-soa-c03

Meta Description:
Study guide for AWS VPC scenarios involving NAT gateways, VPC endpoints, routing, VPN connectivity, flow logs, security groups, and network ACLs.

Tags:
AWS, Amazon VPC, SOA-C03, NAT Gateway, VPC Endpoints, VPC Flow Logs, Route Tables, Network ACLs, Security Groups, VPN, VPC Peering