Troubleshooting VPC Subnet Communication
Question
Your team has set up a VPC with multiple subnets.
There is a webserver hosted in one subnet and a database server hosted in another subnet.
During the initial test, the webserver could not establish communication with the database server.
Which of the following would you need to check for this?
Answers
Explanations
Click on the arrows to vote for the correct answer
A. B. C. D.Correct Answer: C.
The AWS Documentation mentions the following.
A security group acts as a virtual firewall that controls the traffic for one or more instances.
When you launch an instance, you associate one or more security groups with the instance.
You add rules to each security group that allows traffic to or from its associated instances.
You can modify the rules for a security group at any time; the new rules are automatically applied to all instances associated with the security group.
When we decide whether to allow traffic to reach an instance, we evaluate all the rules from all the security groups associated with the instance.
Option A is incorrect since this is an internal communication problem.
Option B is incorrect because the Route table defines the traffic that goes in and out of the subnet, cannot manage the traffic between servers just like Security groups.
Option D is incorrect because the communication with the database needs to be done via the Private IP for security concerns.
For more information on security groups, please visit the below URL-
https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/using-network-security.htmlWhen a web server in one subnet is unable to communicate with a database server hosted in another subnet, it is likely that the issue is related to the networking configuration within the VPC. There are several things that you would need to check in order to resolve this issue.
A. Ensure that the Internet gateway is attached to the VPC: This option is not related to the issue at hand. An Internet Gateway (IGW) is used to enable communication between resources within a VPC and the Internet. It is not required for communication between resources within the same VPC, and therefore, checking the attachment of the IGW to the VPC would not be relevant to the issue at hand.
B. Ensure that the route tables are modified so that communication is possible across subnets: The communication between subnets is achieved by routing tables in the VPC. Route tables determine where network traffic is directed within the VPC. If the route tables are not configured properly, communication between subnets will not be possible. Therefore, it is essential to verify that the route tables are correctly configured to allow communication between the web server and the database server.
C. Ensure the security group for the database server is allowing the required inbound communication: Security groups are virtual firewalls that control the inbound and outbound traffic for an EC2 instance. If the security group for the database server is not allowing the required inbound communication, then the web server may not be able to establish a connection to the database server. It is essential to verify that the security group for the database server is allowing the necessary inbound traffic from the web server.
D. Ensure a public IP is assigned to the database server: The public IP is used to enable communication between resources within a VPC and the Internet. However, in this scenario, the database server and the web server are both within the same VPC. Therefore, it is not necessary to assign a public IP to the database server to enable communication between the web server and the database server.
In conclusion, the correct answer to this question would be to check that the route tables are modified so that communication is possible across subnets and to verify that the security group for the database server is allowing the required inbound communication.
