Examkin

Question

Difficulty: MediumStrengthening Identity, Access, and Network Security

An enterprise has an existing workload running on Amazon EC2 instances in a private subnet of VPC A. The application on these instances must access Amazon DynamoDB and must also assume a cross-account IAM role in Account B to write data to a partner API. Currently, all outbound traffic from the private subnet is routed through a NAT Gateway to the internet. To strengthen network and identity security, a solutions architect must ensure that traffic to DynamoDB does not traverse the public internet, and the IAM role in Account B can only be assumed if the request originates from VPC A.

Which combination of actions should the solutions architect take to meet these requirements? (Select TWO.)

  1. Create a gateway VPC endpoint for DynamoDB in VPC A, and associate it with the route table of the private subnet.Answer
  2. Create an interface VPC endpoint for AWS STS in VPC A. In Account B, update the trust policy of the IAM role to allow assumption by the application's IAM principal with a condition restricting aws:sourceVpc to the VPC ID of VPC A.Answer
  3. C
    Create an interface VPC endpoint for DynamoDB in VPC A, and associate it with a Route 53 private hosted zone to resolve DynamoDB service endpoints.
  4. D
    Attach a Service Control Policy (SCP) at the root of the AWS Organization that restricts sts:AssumeRole to the IAM role in Account B, with a condition allowing access only when the principal's VPC ID matches VPC A.
  5. E
    Create an AWS Transit Gateway to route STS traffic directly to Account B, and configure a Customer Managed Key (CMK) policy in Account B to restrict the kms:ViaService condition to AWS STS.

Answer

Create a gateway VPC endpoint for DynamoDB in VPC A and associate it with the route table of the private subnet, and create an interface VPC endpoint for AWS STS in VPC A, updating the target IAM role's trust policy in Account B with an aws:sourceVpc condition for VPC A.
To secure the network path to DynamoDB, a gateway VPC endpoint is created and added to the private subnet's route table. This redirects DynamoDB traffic from the NAT Gateway directly to the AWS internal network. To restrict cross-account role assumption to requests originating from the VPC, an interface VPC endpoint for AWS STS must be created in VPC A. When the application calls sts:AssumeRole through this VPC endpoint, the request carries the source VPC ID. The trust policy of the role in Account B can then validate this with the aws:sourceVpc condition key, blocking any calls from outside the VPC.

Step-by-Step Solution

1
Configure private access to DynamoDB.
A gateway VPC endpoint for Amazon DynamoDB is created in VPC A and associated with the private subnet's route table, routing DynamoDB traffic directly through the AWS network.
This prevents DynamoDB traffic from routing through the NAT Gateway and traversing the public internet.
2
Establish a private path for STS calls.
An interface VPC endpoint for AWS STS (com.amazonaws.region.sts) is deployed in VPC A.
This routes the sts:AssumeRole calls through the VPC endpoint, appending the VPC metadata (such as the VPC ID) to the request context.
3
Enforce VPC source restriction on the target IAM role.
The trust policy of the cross-account role in Account B is updated with a StringEquals condition checking if the aws:sourceVpc matches the ID of VPC A.
This ensures that the cross-account role can only be assumed when the STS request originates from VPC A.

Key Concept

VPC endpoints allow private routing to AWS services, and interface endpoints preserve VPC context (such as VPC ID) for IAM policy condition evaluations.
Rate this question

Topics

Strengthening Identity, Access, and Network Security