Examkin

Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

An enterprise has a multi-account AWS environment. Account A (Shared Services) hosts a private Amazon API Gateway API. Account B (Production) has Amazon EC2 instances running in a private subnet that must invoke this private API. Network connectivity between Account A's VPC and Account B's VPC is established via an AWS Transit Gateway. A Solutions Architect must strengthen the identity and network security posture of this existing integration. The traffic must remain private, be restricted to Account B's VPC, and the API must only be invocable by a specific IAM role (API-Invoker-Role) assigned to the EC2 instances in Account B. Which of the following actions should the Solutions Architect take to meet these requirements? (Select two.)

  1. Enable AWS_IAM authorization on the private API Gateway API. Apply a resource policy to the API Gateway API that permits the execute-api:Invoke action for the API-Invoker-Role ARN from Account B, and denies all requests that do not originate from the interface VPC endpoint.Cevap
  2. Create an Interface VPC Endpoint for API Gateway (com.amazonaws.region.execute-api) in Account A's VPC. Authorize the association of the automatically generated Route 53 private hosted zone in Account A with Account B's VPC, and then associate the private hosted zone with Account B's VPC.Cevap
  3. C
    Attach a Service Control Policy (SCP) at the Organization root that grants the API-Invoker-Role in Account B the execute-api:Invoke permission to the private API in Account A, ensuring the local IAM policies in Account B do not require modification.
  4. D
    Create an Interface VPC Endpoint for API Gateway (com.amazonaws.region.execute-api) in Account A's VPC, and rely on default Route 53 Resolver settings to resolve the private API endpoint DNS name across the Transit Gateway connection.
  5. E
    Configure a Direct Connect Gateway attached to the Transit Gateway to perform transitive routing of API Gateway traffic, and add a static route pointing to the regional public IP address of the API Gateway.

Cevap

Configure the private API Gateway to use AWS_IAM authorization and apply a resource policy that allows the IAM role in Account B while restricting access to the VPC Endpoint. Additionally, deploy the execute-api VPC endpoint in Account A and associate its Route 53 private hosted zone with the VPC in Account B.
To securely integrate the private API Gateway in Account A with Account B, the solutions architect must configure AWS_IAM authorization on the API Gateway and define a resource policy that allows the IAM role in Account B while denying any traffic not originating from the Interface VPC Endpoint. Because the VPC endpoint is deployed in Account A, Route 53 Private Hosted Zone (PHZ) associations must be authorized and created for Account B's VPC. This allows the EC2 instances in Account B's VPC to resolve the private DNS endpoint names directly to the private IPs of the interface endpoint over the Transit Gateway connection.

Adım Adım Çözüm

1
Configure identity-based access control for the API Gateway API.
By enabling AWS_IAM authorization, requests must be signed with AWS SigV4. The resource policy permits the specific IAM role from Account B to invoke the API, while a Deny block restricts traffic to the Interface VPC Endpoint ID to ensure network isolation.
This strengthens both identity and network security at the API Gateway boundary.
2
Set up private network connectivity and cross-account DNS resolution.
Creating an Interface VPC Endpoint in Account A provides a private entry point. Authorizing and accepting the Route 53 Private Hosted Zone (PHZ) association for Account B's VPC allows EC2 instances in Account B to resolve the API's private DNS name to the endpoint's private IP addresses.
This enables secure, private DNS resolution across the Transit Gateway connection without traversing the public internet.

Anahtar Kavram

Cross-account private API Gateway access requires combining Interface VPC Endpoints, cross-account Route 53 Private Hosted Zone associations, and API Gateway resource policies containing IAM and network conditions.
Tahmini Süre:2m 30s
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security