
Answer-first summary for fast verification
Answer: The EC2 instance is not attached to an IAM role that allows write operations to Amazon SQS., There is no interface VPC endpoint configured for Amazon SQS
To diagnose why the Amazon SQS queue is not receiving messages from an EC2 instance in a private subnet, we need to consider the permissions and network configurations that could be affecting the communication between the EC2 instance and the SQS service. Option A is a possible cause because if the EC2 instance does not have an IAM role attached that grants it the necessary permissions to perform write operations on the SQS queue, it won't be able to send messages. Option C is another possible cause because without an interface VPC endpoint for SQS, the EC2 instance in a private subnet would need to route traffic through the internet to reach SQS, which is not possible in this scenario since there's no public subnet or internet gateway. Options B, D, and E are less likely to be the cause because the default security group allows all outbound traffic, the default network ACL allows all inbound and outbound traffic, and the route table would inherently have a route for the VPC's CIDR block, which includes the SQS service's IP address range if an interface VPC endpoint is used.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
A network engineer has set up an Amazon EC2 instance in a private subnet within a VPC that lacks a public subnet. The EC2 instance runs application code designed to send messages to an Amazon SQS queue. The subnet uses the default network ACL without any changes, and the EC2 instance is configured with the default security group without modifications.
The SQS queue is not receiving the messages.
What are two potential reasons for this issue? (Select two.)
A
The EC2 instance is not attached to an IAM role that allows write operations to Amazon SQS.
B
The security group is blocking traffic to the IP address range used by Amazon SQS
C
There is no interface VPC endpoint configured for Amazon SQS
D
The network ACL is blocking return traffic from Amazon SQS
E
There is no route configured in the subnet route table for the IP address range used by Amazon SQS
No comments yet.