VPC endpoints for private access in DynamoDB - Interactive Code Practice

Practice - 5 Tasks

1fill in blank

easy

Complete the code to specify the VPC endpoint type for private DynamoDB access.

DynamoDB

aws ec2 create-vpc-endpoint --vpc-id vpc-123abc --service-name com.amazonaws.us-east-1.dynamodb --vpc-endpoint-type [1]

Drag options to blanks, or click blank then click option'

AInterface

BGateway

CPrivateLink

DGatewayLoadBalancer

Attempts:

3 left

💡 Hint

Common Mistakes

Choosing Interface endpoint which is used for other AWS services like EC2.

Using PrivateLink which is a different technology.

The correct VPC endpoint type for DynamoDB private access is Gateway. This allows routing traffic privately to DynamoDB without using the internet.

2fill in blank

medium

Complete the code to add a route to the route table for the DynamoDB VPC endpoint.

DynamoDB

aws ec2 create-route --route-table-id rtb-456def --destination-prefix-list-id [1] --vpc-endpoint-id vpce-789ghi

Drag options to blanks, or click blank then click option'

Apl-12345678

Bpl-87654321

Cpl-abcdef12

Dpl-fedcba98

Attempts:

3 left

💡 Hint

Common Mistakes

Using a prefix list ID for another service.

Confusing the VPC endpoint ID with the prefix list ID.

The destination prefix list ID for DynamoDB in the region is pl-12345678. This ID represents the DynamoDB service prefix list for routing.

3fill in blank

hard

Fix the error in the command to describe the VPC endpoints filtering by service name.

DynamoDB

aws ec2 describe-vpc-endpoints --filters Name=service-name,Values=[1]

Drag options to blanks, or click blank then click option'

Adynamodb.us-east-1

Bdynamodb

Ccom.amazonaws.us-east-1.dynamodb

Daws.dynamodb

Attempts:

3 left

💡 Hint

Common Mistakes

Using only the service name without region.

Using incorrect service name formats.

The full service name for DynamoDB VPC endpoint includes the region and prefix: com.amazonaws.us-east-1.dynamodb. Using only 'dynamodb' will not filter correctly.

4fill in blank

hard

Fill both blanks to create a policy that allows access to DynamoDB via the VPC endpoint.

DynamoDB

{
  "Statement": [{
    "Effect": "Allow",
    "Principal": "*",
    "Action": "[1]",
    "Resource": "*",
    "Condition": {
      "StringEquals": {
        "aws:SourceVpce": "[2]"
      }
    }
  }]
}

Drag options to blanks, or click blank then click option'

Adynamodb:*

Bvpce-789ghi

Cs3:*

Dlambda:InvokeFunction

Attempts:

3 left

💡 Hint

Common Mistakes

Using unrelated service actions like S3 or Lambda.

Not specifying the VPC endpoint ID in the condition.

The action must be dynamodb:* to allow all DynamoDB actions. The condition key aws:SourceVpce requires the VPC endpoint ID, which is typically a string like 'vpce-xxxxxx'. Here, 'B' is a placeholder for the VPC endpoint ID.

5fill in blank

hard

Fill the blanks to create a DynamoDB client in Python that connects through the VPC endpoint.

DynamoDB

import boto3

client = boto3.client('[1]', region_name='us-east-1')

response = client.[2]()

Drag options to blanks, or click blank then click option'

Adynamodb

Bvpce-123abc

Cdescribe_table

Dlist_tables

Attempts:

3 left

💡 Hint

Common Mistakes

Using wrong service names like 's3'.

Using incorrect method names like 'describe_table'.

Thinking a custom endpoint_url is needed for Gateway endpoints.

The client service name is dynamodb. To list tables, the method is list_tables. For VPC Gateway endpoints with DynamoDB, boto3 automatically routes traffic privately through the endpoint based on VPC route tables; no custom endpoint_url is required.