Amazon Managed Grafana VPC Connection for RDS

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

C Create an AWS PrivateLink endpoint to establish a secure, private connection between Amazon Managed Grafana and the RDS database within the VPC.

Question

A company wants to set up Amazon Managed Grafana as its visualization tool. The company wants to visualize data from its Amazon RDS database as one data source. The company needs a secure solution that will not expose the data over the internet. Which solution will meet these requirements?
  1. Create an Amazon Managed Grafana workspace without a VPC. Create a public endpoint for the RDS database. Configure the public endpoint as a data source in Amazon Managed Grafana.
  2. Create an Amazon Managed Grafana workspace in a VPC. Create a private endpoint for the RDS database. Configure the private endpoint as a data source in Amazon Managed Grafana.
  3. Create an Amazon Managed Grafana workspace without a VPCreate an AWS PrivateLink endpoint to establish a connection between Amazon Managed Grafana and Amazon RDS. Set up Amazon RDS as a data source in Amazon Managed Grafana. Correct Answer
  4. Create an Amazon Managed Grafana workspace in a VPC. Create a public endpoint for the RDS database. Configure the public endpoint as a data source in Amazon Managed Grafana.

Key Takeaways

The exam tests the understanding that Amazon Managed Grafana works by connecting TO a VPC via PrivateLink rather than residing inside it, making option C the technically precise answer while B is misleading.

This question explores how to securely connect Amazon Managed Grafana to an Amazon RDS database without exposing data over the internet, focusing on PrivateLink and VPC integration.

Common mistake: Most learners select B because they assume 'Private endpoint' implies the workspace must be created inside a VPC, ignoring the specific architecture where AMG connects externally via PrivateLink.

Expert Analysis

Why the Answer Is Correct

Option C is the correct solution because Amazon Managed Grafana (AMG) is a fully managed service that does not run inside your VPC; instead, it connects to your VPC using AWS PrivateLink. By creating a PrivateLink endpoint (Interface Endpoint) in your VPC, you allow AMG to securely access the RDS database without traversing the public internet. This meets the requirement of not exposing data over the internet while adhering to the actual service architecture.

Why the Other Options Are Wrong

Options A and D are incorrect because they use public endpoints for RDS, which exposes the database to the internet, violating the security requirement. Option B is incorrect because it suggests creating an AMG workspace 'in a VPC'. AMG workspaces are global resources that connect to a VPC via PrivateLink, they are not instantiated inside a VPC like an EC2 instance. While the connection is private, the phrasing in B is architecturally inaccurate compared to C.

Community Comment Notes

Many learners were confused by the distinction between being 'in' a VPC versus connecting 'to' a VPC. As user NSA_Poker noted, 'AMG is NOT created within a VPC; AMG connects to a VPC.' User LeonSauveterre correctly pointed out that PrivateLink endpoints must reside within a VPC, but the Workspace itself is external. Users like Sergiuss95 conflated 'private endpoint' with being inside a VPC, leading to the vote split between B and C.

Official Reference

https://docs.aws.amazon.com/grafana/latest/userguide/AMG-configure-nac.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When dealing with managed services like AMG, Aurora Serverless, or Fargate, remember they often don't live 'inside' your VPC but connect to it. Always look for options describing 'connection', 'integration', or 'PrivateLink' rather than 'created in VPC'.

Frequently Asked Questions

Why can't I create an AMG workspace inside a VPC?

AMG is a fully managed service that runs outside your account's VPC. It connects to your VPC via PrivateLink interfaces.

Is a Private Link endpoint the same as a VPC endpoint?

Yes, AWS PrivateLink allows you to expose services privately using Interface Endpoints (VPC Endpoints) within your VPC.

More SAA-C03 FAQ →

Community Votes

B
65%
C
35%

65% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 16 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 16

  1. Sergiuss95 👍 6 Answered B
    I think is b. Private endpoint sounds like private vpc endpoint, that is equals to privatelink
  2. venutadi 👍 4 Answered C
    Once you configure direct connectivity between a Grafana workspace and a VPC, Amazon Managed Grafana creates and manages an elastic network interface (ENI) per subnet to connect to the VPC. This enables the Grafana workspace to connect to data sources within the VPC, such as OpenSearch domains or RDS databases. Additionally, all traffic is now routed through the configured VPC, including alert destination and data source connectivity.
  3. NSA_Poker 👍 3 Answered C
    (B or C)?-1 = Do we create AMG workspace in a VPC OR do we create AMG workspace without a VPC? AMG is NOT created within a VPC; AMG connects to a VPC. "Currently, you can connect one Amazon Managed Grafana workspace to one VPC endpoint in the same region and same account. However, you can use Virtual Private Cloud peering or AWS Transit Gateway to connect the cross-region or cross-account VPCs, then connect the select the VPC endpoint that’s in the same account and same region as your Amazon Managed Grafana workspace." -FAQs (C) is correct.
  4. LeonSauveterre 👍 3 Answered B
    A & D are out, because they're using public endpoints, which causes exposure over the Internet. Why C is wrong: If the Grafana workspace is not in a VPC, it cannot use PrivateLink endpoints. PrivateLink endpoints must reside within a VPC. If Grafana is outside the VPC, PrivateLink cannot establish the required secure, private connection.
  5. chest_jd 👍 3 Answered B
    Choice B or C could be resolved in this way: B. Create an Amazon Managed Grafana workspace in a VPC C. Create an Amazon Managed Grafana workspace without a VPC As far as I know we cannot create workspace without VCP
Show 11 more comments
  1. Nm55569 👍 3 Answered B
    https://aws.amazon.com/about-aws/whats-new/2022/11/amazon-managed-grafana-connection-data-sources-hosted-virtual-private-cloud/
  2. EdricHoang 👍 3 Answered B
    Its B. C is also a valid choice "Not exposing to the internet" is letting me eliminate C
  3. ike001 👍 2
    B as you need to create Managed Grafana workspace with a VPC for private access https://docs.aws.amazon.com/grafana/latest/userguide/AMG-configure-nac.html
  4. sandordini 👍 2
    I guess they mean C, But again, it's strange... IMO B would also work... There is no requirement for the least effort... Pls, correct me if I'm wrong...
  5. GOTJ 👍 1 Answered B
    With all due respect, once again options are poorly written: you don't create an Amazon Managed Grafana workspace IN or WITHOUT a VPC. Instead, you create an AMG WITH or WITHOUT a VPC CONNECTION: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-create-workspace.html (Step 8, Optional): You can choose to connect to an Amazon virtual private cloud (VPC) on this page, or you can connect to a VPC later. To learn more, see Connect to data sources or notification channels in Amazon VPC from Amazon Managed Grafana. According to the "to learn more" link, if you create the AMG WITHOUT a VPC CONNECTION: By default, traffic from your Amazon Managed Grafana workspace to data sources or notification channels flows via the public Internet. This limits the connectivity from your Amazon Managed Grafana workspace to services that are publicly accessible. So option "C" must be discarded as it doesn't comply company requirements of avoid using internet
  6. tonybuivannghia 👍 1 Answered C
    After searching effort, I agree C is correct because AMG workspace can't include in VPC. When you have not configured a private VPC, and Amazon Managed Grafana is connecting to publicly accessible data sources, it connects to some AWS services in the same region via AWS PrivateLink. This includes services such as CloudWatch, Amazon Managed Service for Prometheus and AWS X-Ray. Traffic to those services does not flow via the public Internet.
  7. VortexMD 👍 1
    AWS PrivateLink provides private connectivity between virtual private clouds (VPCs), supported AWS services, and your on-premises networks without exposing your traffic to the public internet. Interface VPC endpoints, powered by PrivateLink, connect you to services hosted by AWS Partners and supported solutions available in AWS Marketplace.
  8. ARV14 👍 1 Answered C
    https://docs.aws.amazon.com/grafana/latest/userguide/VPC-endpoints.html , https://aws.amazon.com/about-aws/whats-new/2022/11/amazon-managed-grafana-connection-data-sources-hosted-virtual-private-cloud/
  9. tch 👍 1 Answered C
    should be C: https://docs.aws.amazon.com/grafana/latest/userguide/AMG-configure-nac.html Amazon Managed Grafana workspace not created in VPC.....
  10. Bazzix 👍 5 Answered B
    B is correct
  11. osmk 👍 3 Answered C
    cccc ccc

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide