A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network. What actions should the SysOps Administrator take to meet these requirements?
A.
Create a VPC endpoint for the S3 bucket, and create an IAM policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
B.
Create a VPC endpoint for the S3 bucket, and create a S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
C.
Create a service-linked role for Amazon EC2 that allows the EC2 instances to interact directly with Amazon S3, and attach an IAM policy to the role that allows the EC2 instances full access to the S3 bucket.
D.
Create a NAT gateway in the VPC, and modify the VPC route table to route all traffic destined for Amazon S3 through the NAT gateway.
B. Create a VPC endpoint for the S3 bucket, and create a S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
To restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC and ensure all traffic remains over the AWS private network, you should use a VPC endpoint for S3 and a bucket policy.
B.
Not D because you can't route to S3 through a private link via a NAT gateway specifically and on its own.
C is required but in itself it won't restrict the bucket and it won't force going via the private link. https://aws.amazon.com/premiumsupport/knowledge-center/ec2-instance-access-s3-bucket/#:~:text=To%20connect%20to%20your%20S3,need%20to%20do%20the%20following%3A&text=Create%20and%20attach%20an%20AWS,have%20a%20policy%20denying%20access.
B will restrict the bucket to that VPC via the private link (still have to configure the endpoint policy even though this is not mentioned), hence this is the right answer.
A is similar but wrong because bucket access is limited by bucket policies, not IAM policies (which go on users, groups or roles).
Option B doesn't talk about EC2 instances at all, but limits access to the S3 bucket from the VPC endpoint. Can anyone please explain why option C is incorrect?
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
nicat
Highly Voted 2 years, 9 months agoalbert_kuo
Most Recent 11 months, 2 weeks agoRicardoD
2 years, 8 months agojackdryan
2 years, 8 months agovob
2 years, 8 months agoyli
2 years, 8 months agonarayanan010
2 years, 8 months agonarayanan010
2 years, 9 months agoshimmy
2 years, 8 months ago