Examkin

Question

Difficulty: MediumVPC Network Security

A company is hosting a secure data processing application on Amazon EC2 instances within a private subnet. The instances must retrieve training datasets from a specific Amazon S3 bucket. Security policies dictate that the VPC must not have an Internet Gateway or a NAT Gateway, and the EC2 instances must be restricted from accessing any other S3 buckets in AWS. A solutions architect deploys a Gateway VPC Endpoint for Amazon S3 to enable private connectivity. Which configuration should the solutions architect implement to restrict the instances to only access the specified S3 bucket?

  1. A
    Configure the Security Group associated with the EC2 instances to restrict outbound traffic to the Amazon Resource Name (ARN) of the specific S3 bucket.
  2. B
    Add a route to the private subnet's route table that maps the specific S3 bucket's IP addresses to the S3 Gateway VPC endpoint.
  3. Attach a custom VPC endpoint policy to the S3 Gateway VPC endpoint that allows S3 actions only when the resource matches the specific S3 bucket's ARN.Answer
  4. D
    Deploy an AWS WAF Web ACL on the subnet's network interfaces to inspect and deny outbound requests destined for unauthorized S3 buckets.

Answer

Attach a custom VPC endpoint policy to the S3 Gateway VPC endpoint that allows S3 actions only when the resource matches the specific S3 bucket's ARN.
A VPC endpoint policy is an IAM resource policy that you attach to a VPC endpoint to control access to the service. By default, endpoints have full access. A custom policy can restrict access to specific S3 buckets by specifying their ARNs in the 'Resource' block, ensuring that EC2 instances using the endpoint can only interact with the approved bucket.

Step-by-Step Solution

1
Analyze the constraint that EC2 instances must access a specific S3 bucket privately without traversing the internet or NAT gateways.
Confirm that a Gateway VPC Endpoint for S3 is the correct private networking route, but by default, it permits access to all S3 buckets.
This sets the foundation for understanding where the access restriction must be applied.
2
Evaluate the capabilities of Security Groups and Route Tables to restrict access to a specific S3 bucket.
Determine that Security Groups and Route Tables operate at the network layers (IP/port) and cannot inspect or filter S3 traffic by bucket ARN.
This rules out standard subnet and interface-level network configurations.
3
Select the correct policy enforcement mechanism for VPC Endpoints.
Apply a custom VPC endpoint policy to the S3 Gateway endpoint that specifies the S3 bucket's ARN in the resource block of the policy.
VPC endpoint policies act as a network perimeter filter, allowing fine-grained IAM controls at the VPC boundary.

Key Concept

VPC Endpoint Policies
Estimated Time:1m 30s
Rate this question

Topics

VPC Network Security

More questions from this topic