Examkin

Question

Difficulty: HardVPC Network Security

An enterprise hosts a batch processing application on Amazon EC2 instances in a private VPC subnet. The application must securely upload large datasets to a specific Amazon S3 bucket within the same AWS Region. Security policy requires that all traffic to Amazon S3 must remain within the AWS network, and no other outbound internet access should be permitted from the EC2 instances. The architecture must minimize data transfer costs and administrative overhead. Which combination of actions should a solutions architect perform to meet these requirements? (Select TWO.)

  1. Create a Gateway VPC Endpoint for Amazon S3, associate it with the private subnet's route table, and apply an endpoint policy that restricts access to the organization's specific S3 bucket.Answer
  2. Configure the security group attached to the EC2 instances to allow outbound HTTPS traffic to the AWS-managed prefix list for Amazon S3, and remove the default rule allowing all outbound traffic (0.0.0.0/0).Answer
  3. C
    Configure the private subnet's Network ACL to allow outbound traffic only to the Amazon S3 Gateway Endpoint ID, and deny all other outbound traffic.
  4. D
    Deploy a NAT Gateway in the private subnet and create a route in the route table for Amazon S3 traffic pointing to the NAT Gateway with an attached AWS WAF web ACL to filter bucket access.
  5. E
    Create an Interface VPC Endpoint for Amazon S3, manually add a route to the subnet's route table targeting the endpoint interface's Elastic Network Interface (ENI) for all destinations, and restrict access using a Security Group outbound rule targeting the S3 DNS name.

Answer

Create a Gateway VPC Endpoint for Amazon S3, associate it with the private subnet's route table, and apply an endpoint policy that restricts access to the organization's specific S3 bucket. Additionally, configure the security group attached to the EC2 instances to allow outbound HTTPS traffic to the AWS-managed prefix list for Amazon S3, and remove the default rule allowing all outbound traffic.
The correct strategy combines the creation of a Gateway VPC Endpoint for Amazon S3 with security group outbound rules. The Gateway Endpoint provides secure, private access to Amazon S3 at no additional cost and automatically handles routing updates. The endpoint policy secures S3 access by ensuring instances can only interact with the specified bucket. By configuring the EC2 security group to permit outbound HTTPS traffic only to the AWS-managed prefix list for S3 and removing the default open outbound rule, the instances are prevented from reaching any other public internet destinations.

Step-by-Step Solution

1
Analyze the connectivity requirements.
The application needs access to Amazon S3 but must not have general outbound internet access.
This establishes the scope of VPC network security controls needed.
2
Select the most cost-effective and secure private connectivity option for Amazon S3.
A Gateway VPC Endpoint for Amazon S3 is chosen over an Interface VPC Endpoint because it is free of charge and automatically routes traffic using prefix lists in the subnet's route table.
Gateway endpoints are the standard, zero-cost method for connecting to S3 from within a VPC.
3
Enforce the security restriction for the specific S3 bucket.
Apply a VPC Endpoint policy to the Gateway VPC Endpoint that permits access only to the target S3 bucket.
VPC Endpoint policies allow fine-grained access control to AWS resources from within the VPC.
4
Restrict outbound traffic on the EC2 instances using security groups.
Modify the instance security group to allow outbound traffic on port 443 only to the AWS-managed prefix list for Amazon S3 (pl-xxxxxx) and delete the default 0.0.0.0/0 outbound rule.
This ensures the instances cannot connect to any other destinations on the public internet, satisfying the zero-internet egress security policy.

Key Concept

Combining S3 Gateway Endpoints with Security Group prefix list filtering allows secure, cost-effective, private resource access while preventing all other egress to the internet.
Rate this question

Topics

VPC Network Security

More questions from this topic