A company mandates that an Amazon S3 gateway endpoint must allow traffic to trusted buckets only. Which method should a solutions architect implement to meet this requirement?
A.
Create a bucket policy for each of the company's trusted S3 buckets that allows traffic only from the company's trusted VPCs.
B.
Create a bucket policy for each of the company's trusted S3 buckets that allows traffic only from the company's S3 gateway endpoint IDs.
C.
Create an S3 endpoint policy for each of the company's S3 gateway endpoints that blocks access from any VPC other than the company's trusted VPCs.
D.
Create an S3 endpoint policy for each of the company's S3 gateway endpoints that provides access to the Amazon Resource Name (ARN) of the trusted S3 buckets.
Ans: D
Although B works, it is extremely tedious to create bucket policies if the company has 100's of buckets.
Endpoint policy is the first line of defense. it is possible to add several buckets as resources to one End point policy and attach it to the Endpoint.
"Resource": ["arn:aws:s3:::my_secure_bucket",
"arn:aws:s3:::my_secure_bucket/*"]
By default, all Amazon S3 buckets and objects are private. Only the resource owner which is the AWS account that created the bucket can access that bucket.
What of the below
Control access using bucket policies
You can use bucket policies to control access to buckets from specific endpoints, VPCs, IP address ranges, and AWS accounts.
Example: Restrict access to a specific endpoint
You can create a bucket policy that restricts access to a specific endpoint by using the aws:sourceVpce condition key. The following policy denies access to the specified bucket unless the specified gateway endpoint is used. This example assumes that there is also a policy statement that allows the access required for your use cases.
https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html
Answer D. The difference between B and D is who should be restricted. B is to restrict endpoints while D is to restrict buckets. The question is to restrict buckets, not endpoints.
https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-s3.html#vpc-endpoints-policies-s3:
"You can use bucket policies to control access to buckets from specific endpoints, or specific VPCs."
Answer is D
D for sure.
Each spoke VPC only needs to connect to the Transit Gateway to gain access to other connected VPCs. Transit Gateway across different regions can peer with each other to enable VPC communications across regions.
Whenever you think of centralizing multiple vpcs and vpns think transit gateway
D All types of policies — IAM user policies, endpoint policies, S3 bucket policies, and Amazon S3 ACL policies (if any) — must grant the necessary permissions for access to Amazon S3 to succeed.
D. VPC endpoints for S3 are secured through VPC endpoint access polices. This allows you to set which S3 buckets the endpoints should and should not have access to. By default, any user or service within the VPC, has access to any S3 resource. Use together with S3 bucket policies to further refine access control over your buckets and objects.
https://tutorialsdojo.com/amazon-s3-bucket-policies-for-vpc-endpoints/
The answer is D. The requirement is to allow traffic in VPC endpoint only. The bucket policy (as proposed in answer B) controls the access in the S3 bucket only. The solution B alone would allow traffic coming from untrusted S3 buckets to the VPC endpoint, which is a scenario to be avoided
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
Mahesh_11
Highly Voted 3 years, 8 months agoPaitan
Highly Voted 3 years, 8 months agovasmourir
3 years, 8 months agotinyshare
3 years, 7 months agoOnimole
Most Recent 2 years, 10 months agocannottellname
3 years, 6 months agotinyshare
3 years, 7 months agoRidzV
3 years, 6 months agosyu31svc
3 years, 7 months agoKK_uniq
3 years, 7 months agoKK_uniq
3 years, 7 months agoallanm
2 years, 9 months agoSun927
3 years, 7 months agomyutran
3 years, 7 months agoarunchu
3 years, 7 months agomlimache
3 years, 7 months agobleble00001
3 years, 7 months agoanpt
3 years, 7 months agodin_10009
3 years, 7 months agoMasud
3 years, 7 months agomemoer6
3 years, 7 months ago