An enterprise wants to improve the network and identity security posture for an existing multi-account architecture. Account A hosts an application running on Amazon EC2 instances in a private subnet within VPC-A. The application needs to communicate with a proprietary web service hosted in Account B behind an internal Application Load Balancer (ALB) in VPC-B. VPC-A and VPC-B are interconnected using AWS Transit Gateway. The application also needs to communicate with a public third-party REST API at api.partner.corp.
A solutions architect must meet the following security requirements:
- Prevent DNS tunneling exfiltration and restrict DNS resolution in VPC-A to only the internal domain of Account B (*.internal.corp) and the partner domain (api.partner.corp).
- Restrict network traffic between VPC-A and VPC-B such that only the EC2 instances in VPC-A can access the internal ALB in VPC-B, preventing any transitive traffic from other VPCs connected to the Transit Gateway.
- Enforce that the EC2 instances in VPC-A can only call the external partner API, blocking all other outbound HTTP/HTTPS internet traffic from VPC-A.
Which of the following actions should the Solutions Architect take to meet these security requirements? (Select TWO.)
- Configure a Route 53 Resolver DNS Firewall rule group with a rule to allow domain names matching *.internal.corp and api.partner.corp, followed by a rule to block all other domains, and associate this rule group with VPC-A. Implement an AWS Network Firewall firewall in VPC-A and route outbound internet traffic through it, configuring a stateful rule group that allows HTTP/HTTPS traffic targeting api.partner.corp while blocking all other outbound destinations.Answer
- In the security group attached to the internal ALB in VPC-B, allow inbound traffic only from the specific private IP addresses of the EC2 instances in VPC-A. In the Transit Gateway route tables, associate the VPC-A attachment with a route table containing a route to VPC-B, and associate the VPC-B attachment with a route table that contains a route to VPC-A but has no routes or propagation configurations to other VPCs.Answer
- CCreate a Service Control Policy (SCP) at the Organization root that denies all network traffic to domains other than *.internal.corp and api.partner.corp, and attach it to Account A. In the security group of the internal ALB in VPC-B, authorize the IAM role of the EC2 instances in VPC-A as the principal source.
- DConfigure a Route 53 Private Hosted Zone for the external domain api.partner.corp in Account B, and associate it with VPC-A. Add an AWS WAF WebACL to the NAT Gateways in VPC-A with a rule configured to allow traffic only when the host header matches api.partner.corp and block all other traffic.
- EConfigure a Direct Connect Gateway to route traffic between VPC-A and VPC-B transitively, bypassing the Transit Gateway. Configure Route 53 Resolver endpoints in VPC-A to forward all DNS queries to a private hosted zone in VPC-B that has a wildcard rule blocking DNS exfiltration.