Learn how to identify and resolve high NAT gateway costs for an AWS data processing solution using VPC flow logs and optimizing traffic with VPC endpoints and security groups.
Table of Contents
Question
A company is replatforming a legacy data processing solution to AWS. The company deploys the solution on Amazon EC2 Instances in private subnets that are in one VPC.
The solution uses Amazon S3 for abject storage. Both the data that the solution processes and the data the solution produces are stored in Amazon S3. The solution uses Amazon DynamoDB to save its own state. The company collects flow logs for the VPC. The solution uses one NAT gateway to register its license through the internet. A software vendor provides a specific hostname so the solution can register its license.
The company notices that the AWS bill exceeds the projected budget for the solution. A network engineer uses AWS Cost Explorer to investigate the bill. The network engineer notices that the USE2-NatGateway-Bytes($) usage type is the root cause of the higher than expected bill.
What should the network engineer do to resolve the issue? (Choose two.)
A. Set up Amazon VPC Traffic Mirroring. Analyze the traffic to identify the traffic that the NAT gateway processes.
B. Examine the VPC flow logs to identity the traffic that traverses the NAT gateway.
C. Set up an AWS Cost and Usage Report in the AWS Billing and Cost Management console. Examine the report to find more details about the NAT gateway charges.
D. Verify that the security groups attached to the EC2 instances allow outgoing traffic only to the IP addresses that the hostname resolves to, the VPC CIDR block, and the AWS IP address ranges for Amazon S3 and DynamoDB.
E. Verify that the gateway VPC endpoints for Amazon S3 and DynamoDB are both set up and associated with the route tables of the private subnets.
Answer
B. Examine the VPC flow logs to identity the traffic that traverses the NAT gateway.
D. Verify that the security groups attached to the EC2 instances allow outgoing traffic only to the IP addresses that the hostname resolves to, the VPC CIDR block, and the AWS IP address ranges for Amazon S3 and DynamoDB.
Explanation
To resolve the issue of higher than expected NAT gateway costs for the AWS data processing solution, the network engineer should:
B. Examine the VPC flow logs to identify the traffic that traverses the NAT gateway. VPC flow logs capture information about the IP traffic going to and from network interfaces in the VPC. By analyzing these logs, the engineer can determine what traffic is being sent through the NAT gateway and potentially identify unexpected or unnecessary traffic that is contributing to the high costs.
D. Verify that the security groups attached to the EC2 instances allow outgoing traffic only to the IP addresses that the hostname resolves to, the VPC CIDR block, and the AWS IP address ranges for Amazon S3 and DynamoDB. By restricting outbound traffic to only the necessary destinations, the engineer can prevent the instances from sending unintended traffic through the NAT gateway. The hostname for license registration, the VPC itself, and the S3 and DynamoDB services should be the only allowed outbound destinations.
The other options are less helpful:
A. Traffic Mirroring could provide detailed analysis but is not the simplest starting point.
C. The Cost and Usage Report gives billing details but the cause is already known.
E. VPC endpoints could reduce NAT gateway traffic but the question does not state whether they are already configured. Checking the security groups is a better first step.
In summary, examining the VPC flow logs and verifying strict outbound security group rules are the two most direct ways to identify and limit unexpected traffic through the NAT gateway in order to troubleshoot and reduce the high costs.
Amazon AWS Certified Advanced Networking – Specialty ANS-C01 certification exam assessment practice question and answer (Q&A) dump including multiple choice questions (MCQ) and objective type questions, with detail explanation and reference available free, helpful to pass the Amazon AWS Certified Advanced Networking – Specialty ANS-C01 exam and earn Amazon AWS Certified Advanced Networking – Specialty ANS-C01 certification.