Examkin

Question

Difficulty: Very hardStrengthening Identity, Access, and Network Security

An organization operates a multi-account AWS environment structured with AWS Organizations. A central shared services account contains a shared services VPC, and multiple consumer spoke VPCs reside in separate member accounts. All VPCs are interconnected using an AWS Transit Gateway. In the shared services VPC, an Interface VPC Endpoint (AWS PrivateLink) has been created to connect to an external SaaS partner's proprietary API service. The security team requires that only specific IAM roles running application workloads in the spoke VPCs are allowed to access this SaaS API. Furthermore, DNS resolution for the SaaS provider's domain name must resolve to the private IP addresses of the Interface VPC Endpoint from within the spoke VPCs. Which combination of actions should the solutions architect take to meet these requirements in the most secure and operationally efficient manner? (Select TWO.)

  1. Authorize and associate the Route 53 Private Hosted Zone created for the SaaS provider's domain in the shared services account with the spoke VPCs in the consumer accounts.Answer
  2. Configure a VPC endpoint policy on the Interface VPC Endpoint in the shared services VPC that permits access only to the specific IAM role ARNs from the consumer accounts as the principals, and limits the actions to the required SaaS API operations.Answer
  3. C
    Enable private DNS on the Interface VPC Endpoint in the shared services VPC, and enable DNS Support on the Transit Gateway attachments to automatically forward DNS queries for the SaaS domain from the spoke VPCs.
  4. D
    Attach a Service Control Policy (SCP) to the consumer accounts' Organizational Units (OUs) that grants the specific IAM roles access to the SaaS service endpoint while denying access to all other IAM entities.
  5. E
    Establish a separate Direct Connect gateway for each spoke account and configure transitive VPC-to-VPC routing tables within the Direct Connect gateway to direct traffic destined for the SaaS provider through the shared services VPC.

Answer

Authorize and associate the Route 53 Private Hosted Zone created for the SaaS provider's domain in the shared services account with the spoke VPCs in the consumer accounts, and configure a VPC endpoint policy on the Interface VPC Endpoint in the shared services VPC that permits access only to the specific IAM role ARNs from the consumer accounts as the principals.
To secure the PrivateLink endpoint, a resource-based VPC endpoint policy must be configured to permit only the authorized cross-account IAM role ARNs and block all other traffic. To ensure DNS resolution works seamlessly, the Route 53 Private Hosted Zone in the shared services account must be associated with the consumer spoke VPCs in the other accounts. This requires a cross-account authorization and association workflow.

Step-by-Step Solution

1
Configure the resource-based VPC endpoint policy on the Interface VPC Endpoint.
Access is restricted at the network endpoint boundary to only allow the specified cross-account IAM role ARNs, blocking any unauthorized IAM principals from the spoke VPCs.
This establishes least-privilege access at the PrivateLink ingress point for the SaaS API.
2
Authorize the cross-account Route 53 Private Hosted Zone association.
The shared services account (PHZ owner) creates an association authorization for each consumer spoke VPC.
Before a VPC in another AWS account can be associated with a Private Hosted Zone, the zone owner must explicitly authorize it.
3
Associate the Route 53 Private Hosted Zone with the spoke VPCs.
The spoke accounts accept the authorization and associate their VPCs with the Private Hosted Zone.
This allows clients within the spoke VPCs to resolve the SaaS domain name directly to the private IP addresses of the Interface VPC Endpoint in the shared services VPC.

Key Concept

Securing multi-account PrivateLink access and cross-account DNS resolution in a Transit Gateway topology.
Rate this question

Topics

Strengthening Identity, Access, and Network Security