Examkin

Question

Difficulty: EasyStrengthening Identity, Access, and Network Security

An enterprise hosts an application on Amazon EC2 instances inside a private subnet of a VPC. The instances need to download software updates and configurations from Amazon S3. Currently, the subnet route table directs all internet-bound traffic, including requests to Amazon S3, through a NAT Gateway. The security team requires that all data transit to Amazon S3 must remain within the AWS internal network and must not traverse the public internet or the NAT Gateway. Additionally, access to the S3 bucket must be restricted to allow access only from this specific VPC. Which two actions should a solutions architect take to meet these requirements? (Select TWO.)

  1. Create a gateway VPC endpoint for Amazon S3 in the VPC and associate it with the route tables of the private subnet.Answer
  2. Apply a bucket policy to the Amazon S3 bucket that denies all operations unless the request originates from the specified VPC using the aws:sourceVpc condition.Answer
  3. C
    Enable default encryption on the S3 bucket using the AWS-managed KMS key (aws/s3) and modify the key policy to restrict decryption operations to the EC2 instance role.
  4. D
    Attach the VPC to an AWS Transit Gateway and configure a static route in the subnet route tables pointing the S3 prefix list to the Transit Gateway.
  5. E
    Add a bucket policy to the Amazon S3 bucket that restricts access to requests originating from the public IP address of the NAT Gateway using the aws:SourceIp condition.

Answer

Create a gateway VPC endpoint for Amazon S3 in the VPC and associate it with the route tables of the private subnet. Apply a bucket policy to the Amazon S3 bucket that denies all operations unless the request originates from the specified VPC using the aws:sourceVpc condition.
To route traffic to Amazon S3 internally and avoid the NAT Gateway, a gateway VPC endpoint is required. To restrict S3 bucket access to the VPC, a bucket policy using the aws:sourceVpc condition must be applied. These two actions ensure network isolation and resource security.

Step-by-Step Solution

1
Configure internal routing for Amazon S3.
Create a gateway VPC endpoint for S3 and associate it with the private subnet's route table.
This updates the route table with a prefix list pointing to the S3 endpoint, routing all traffic internally and bypassing the NAT Gateway.
2
Apply a resource-based security control to the S3 bucket.
Add an S3 bucket policy that uses the aws:sourceVpc condition to deny access to any requests originating outside the VPC.
This satisfies the requirement to restrict bucket access to only requests coming from the specified VPC.

Key Concept

Gateway VPC endpoints and S3 bucket policies for network isolation
Rate this question

Topics

Strengthening Identity, Access, and Network Security