Examkin

Question

Difficulty: MediumVPC Network Security

An application running on Amazon EC2 instances in a private subnet needs to read and write sensitive data to a specific Amazon S3 bucket. The company's security policy requires that all traffic to Amazon S3 must remain within the AWS network. Additionally, to prevent data exfiltration, the EC2 instances must be blocked from accessing any other Amazon S3 buckets, including those in other AWS accounts.

Which solution should a solutions architect implement to meet these requirements?

  1. Create a gateway VPC endpoint for Amazon S3. Attach an endpoint policy to the gateway endpoint that allows actions only on the specific S3 bucket. Update the route table of the private subnet to direct S3 traffic through the gateway endpoint.Answer
  2. B
    Create a gateway VPC endpoint for Amazon S3. Configure the private subnet's Network ACL with an outbound rule that allows traffic only to the Amazon Resource Name (ARN) of the specific S3 bucket.
  3. C
    Deploy a NAT Gateway in a public subnet, and configure the private subnet's route table to send S3 traffic to the NAT Gateway. Attach an IAM role to the EC2 instances that restricts S3 access to the specific bucket.
  4. D
    Create an interface VPC endpoint for Amazon S3. Associate an AWS WAF web ACL with the interface endpoint, and configure a rule to block S3 requests that target unauthorized bucket names.

Answer

Create a gateway VPC endpoint for Amazon S3, attach a restricted VPC endpoint policy, and update the private subnet's route table.
The correct solution involves deploying a gateway VPC endpoint for Amazon S3, attaching a VPC endpoint policy that limits access to only the specific bucket, and routing S3 traffic through this endpoint by updating the private subnet route table. This ensures the traffic does not traverse the public internet and effectively prevents data exfiltration to unauthorized buckets.

Step-by-Step Solution

1
Create a Gateway VPC Endpoint for Amazon S3 in the VPC.
The VPC endpoint provides private connectivity to S3 without requiring an internet gateway or NAT gateway.
This satisfies the requirement that all traffic to Amazon S3 must remain within the AWS network.
2
Attach a custom VPC endpoint policy to the Gateway VPC Endpoint.
The policy restricts the endpoint to only allow actions targeting the specific S3 bucket.
This prevents data exfiltration by blocking the instances from accessing any other S3 buckets, even if they are in other AWS accounts.
3
Update the route table of the private subnet to include a route pointing to the Gateway VPC Endpoint.
Traffic destined for S3 from the private subnet is automatically routed through the gateway endpoint.
This establishes the routing rule required for the EC2 instances in the private subnet to use the gateway endpoint.

Key Concept

VPC Endpoint Routing and Policies for Data Exfiltration Prevention
Rate this question

Topics

VPC Network Security

More questions from this topic