Examkin

Soru

Zorluk: OrtaStrengthening Identity, Access, and Network Security

An enterprise runs a payment processing microservice hosted on Amazon ECS tasks in VPC A within the provider AWS account. An order management application running on Amazon EC2 instances in VPC B within a separate consumer AWS account needs to securely access the payment API. The applications are currently connected using a VPC peering connection, but the security team wants to restrict network connectivity so that VPC B can only access the payment microservice and cannot initiate any other traffic to VPC A. Additionally, access must be restricted to only the specific IAM role associated with the order management application. Which two actions should a Solutions Architect take to meet these requirements?

  1. Configure an Amazon VPC Endpoint Service in VPC A backed by a Network Load Balancer, and add the Amazon Resource Name (ARN) of the specific consumer IAM role to the allowed principals list of the Endpoint Service.Cevap
  2. Create an interface VPC endpoint in VPC B pointing to the VPC Endpoint Service, and attach a VPC endpoint policy to the interface VPC endpoint that permits access only to the specific consumer IAM role.Cevap
  3. C
    Maintain the VPC peering connection, and attach a Service Control Policy (SCP) to the consumer account's Organizational Unit that restricts the allowed destinations to the IP addresses of the provider's ECS tasks.
  4. D
    Create a Route 53 Private Hosted Zone (PHZ) in VPC A, associate the PHZ with VPC B, and configure a resource-based policy on the hosted zone to restrict DNS resolution requests to the consumer IAM role.
  5. E
    Establish network connectivity via AWS Transit Gateway, and configure AWS KMS using an AWS-managed key (aws/kms) to sign the API requests between the accounts to enforce principal validation.

Cevap

Configure an Amazon VPC Endpoint Service in the provider account backed by a Network Load Balancer and add the consumer IAM role to the allowed principals list, then create an interface VPC endpoint in the consumer account pointing to this service with an endpoint policy that permits access only to that specific IAM role.
The correct options work together to establish AWS PrivateLink. Configuring a VPC Endpoint Service backed by a Network Load Balancer in the provider account restricts network traffic solely to the exposed service, preventing general VPC-to-VPC routing. By adding the specific consumer IAM role to the Allowed Principals of the Endpoint Service, we ensure only that identity can establish the connection. Creating an interface VPC endpoint in the consumer account with a custom VPC endpoint policy restricts endpoint access to only the authorized consumer IAM role.

Adım Adım Çözüm

1
Set up the provider-side VPC Endpoint Service.
A VPC Endpoint Service is created in the provider account (VPC A) backed by a Network Load Balancer (NLB). The NLB routes traffic to the ECS tasks. By default, access is restricted.
This establishes a private service publishing mechanism that does not allow arbitrary network routing, satisfying the requirement to block general VPC-to-VPC communication.
2
Authorize the consumer principal on the Endpoint Service.
The Amazon Resource Name (ARN) of the specific IAM role from the consumer account (VPC B) is added to the Allowed Principals list of the VPC Endpoint Service.
This prevents unauthorized AWS accounts or principals from discovering or connecting to the Endpoint Service.
3
Deploy and configure the Interface VPC Endpoint (AWS PrivateLink) on the consumer side.
An Interface VPC Endpoint is created in VPC B, pointing to the Endpoint Service in VPC A. A VPC endpoint policy is attached to the endpoint, explicitly allowing access only to the specific IAM role.
This establishes the private endpoint within VPC B and enforces identity-based security at the VPC endpoint boundary to ensure only the authorized application role can communicate through it.

Anahtar Kavram

AWS PrivateLink enables secure, private connectivity to services hosted on AWS without exposing the VPCs to the public internet or establishing full network routing like VPC Peering or Transit Gateway. Granular identity-based security is achieved by combining Endpoint Service Allowed Principals (provider side) and VPC Endpoint Policies (consumer side).
Bu soruyu puanla

Konular

Strengthening Identity, Access, and Network Security