How to verify that application in EC2 is using VPC endpoint to communicate with Dynamodb?
I have a Java application which is deployed in EC2 and communicate with Dynamodb. I have enable VPC endpoint (Gateway endpoint) for Dynamodb. But I didn't notice any performance improvement with this change. Theoretically I should see less latency via VPC endpoint compared to public access.
Also based on the tcpdump, I can see our application is still using public IP of dynamodb to communicate.
Here 52.119.232.38 is dynamodb public IP.
How can I verify that our application in EC2 is using VPC endpoint to communicate with Dynamodb ?
- Both EC2 and VPC endpoint enable for same VPC.
You can use AWS cloudtrail to verify this. If you only connect to DynamoDB from the application hosted on AWS network which has the associated VPC Gateway Endpoint, then you should only see private IPs in the Source IP field in the Cloudtrail logs. If you see other public IPs, then it means the DyanmoDB is being accessed over the internet.
- Go to AWS Cloudtrail and filter for
EventSourcedynamodb.amazonaws.com - If you don't see any cloudtrail event, ensure you choose the time period when you expect the application has accessed DynamoDB or manually ssh into the EC2 instance and run some cli commands
aws dynamodb list-tablesand then wait for 10-15 mins for this new event to appear. - Click on the settings icon to show the
Source IP addressfor the events - The
Source IP addressfor the event should be from the CIDR range of your VPC (And in this case the private IP of the EC2 instance) - You can click on the event name and view the raw event which would have a key
vpcEndpointIdwith the value same as the id of the VPC Endpoint
If the source ip is not a private IP of the EC2 instance, ensure the applicable route tables are updated with the gateway endpoint entry by following the To add or remove route tables used by a gateway endpoint section of the link here
- Is there a java.time equivalent of DateTime.dayOfYear().isLeap()?
- WordNet Java API
- Why use a ReentrantLock if one can use synchronized(this)?
- How to format a ZonedDateTime to a String?
- How to short circuit when using a parallel stream with filter and findFirst
- Stream distinct with nested list counts and matching nested list item counts
- Timezone changes are not being persisted in Spring-Boot application
- how to convert decimal to hexadecimal in java
- Why does pattern matching with switch on InetAddress fail with 'does not cover all possible input values'?
- Jackson to parse bean<t> with list of T beans
- Catch a generic exception in Java?
- How to get the whole text of StAX XMLEvent object?
- The www-authenticate header breaks JettyClientHttpConnector
- Why should I use @NaturalId?
- Can't reproduce virtual thread pinning (jdk 21), yet mysql not as parallel as should be
- how to move slider towards left and right using selenium java
- Format of Date in the JavaFX.TableView
- Launch Jetty 9 Programmatically
- Spring JdbcTemplate fail to convert String to Enum (that extend specific interface), since default converter is called even if removed
- GET Request Returning Empty Object in SpringBoot
- Trying to draw box around checkbox and display text using pdfbox
- Extracting date, hour and minute from Instant.now() generated date
- Tail Call Optimisation in Java
- Spring Boot Angular18 Uploading Photo
- What is a IOException, and how do I fix it?
- What does %5B and %5D in POST requests stand for?
- Why couldn't Integer type convert to Double type automatically in Java8 stream API?
- Spring Boot default H2 jdbc connection (and H2 console)
- No content to map due to end-of-input jackson parser
- How to properly add HTTP header in WebService Client (Spring Web Services)