VPC Design for Online Shopping Application
Question
You are designing an online shopping application for your company.
This application will be running in a VPC on EC2 instances behind an Application Load Balancer.
The instances run in an Auto Scaling group across multiple Availability Zones.
The application tier must read and write data to a customer managed database cluster.
There should be no access to the database from the Internet.
But the cluster must be able to obtain software patches from the Internet.
Which VPC design meets these requirements completely?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Answer - C.
The following diagram from the AWS Documentation shows the right setup for this.
Option A is incorrect because the database tier should not be in the public subnet.
Options B and D are incorrect because the NAT gateway needs to be in the public subnet.
For more information on this setup, please refer to the below URL:
https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/vpc-nat-gateway.html![198.51.
198.51]
198.51.
\t
simply GS
100.3 IP) 100.07 NAT gateway
‘Web servers 198 51.100.4 (Elastic IP)
Public subnet
Custom route table
Destination Target
10.0.0.0/16 local
0.00.00 igw-id
a
Main route table
Destination Target
10.0.0.0/16 local
0.0.0.0/0 nat-gateway-id
10.0.0.0/16
Region](https://eaeastus2.blob.core.windows.net/optimizedimages/static/images/AWS-Certified-Advanced-Networking-Specialty/answer/imgquestions_ysmmei.png)
The VPC design that meets the requirements completely is Option D: Public subnets for the application tier and private subnets for the database cluster and NAT Gateway.
Explanation:
The application tier needs to be accessible to the public internet through an Application Load Balancer (ALB). Hence, it should be placed in a public subnet.
On the other hand, the database cluster should not be directly accessible from the internet, so it should be placed in a private subnet. This ensures that the database is protected from unauthorized access from the public internet.
In order for the EC2 instances in the private subnet to access the internet (for example, to download software patches), a NAT Gateway is required. A NAT Gateway is a highly available AWS managed service that allows EC2 instances in private subnets to access the internet while keeping them private and secure.
Therefore, Option D is the correct VPC design that meets the requirement of allowing the database cluster to obtain software patches from the internet while maintaining its security.
Option A is incorrect because it places the database cluster in a public subnet, which exposes it to the public internet.
Option B is incorrect because it places the database cluster in a private subnet with a NAT instance. NAT instances are less scalable, less available, and less secure than NAT Gateways.
Option C is incorrect because it uses a NAT Gateway for the application tier, which is unnecessary since the application tier needs to be accessible from the public internet.
