Exam AWS Certified Solutions Architect - Professional topic 1 question 619 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 619
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A company hosts an application on Amazon EC2 instance and needs to store files in Amazon S3. The files should never traverse the public internet, and only the application EC2 instances are granted access to a specific Amazon S3 bucket. A solutions architect has created a VPC endpoint for Amazon S3 and connected the endpoint to the application VPC.
Which additional steps should the solutions architect take to meet these requirements?

A. Assign an endpoint policy to the endpoint that restricts access to a specific S3 bucket. Attach a bucket policy to the S3 bucket that grants access to the VPC endpoint. Add the gateway prefix list to a NACL of the instances to limit access to the application EC2 instances only.
B. Attach a bucket policy to the S3 bucket that grants access to application EC2 instances only using the aws:SourceIp condition. Update the VPC route table so only the application EC2 instances can access the VPC endpoint.
C. Assign an endpoint policy to the VPC endpoint that restricts access to a specific S3 bucket. Attach a bucket policy to the S3 bucket that grants access to the VPC endpoint. Assign an IAM role to the application EC2 instances and only allow access to this role in the S3 bucket's policy.
D. Assign an endpoint policy to the VPC endpoint that restricts access to S3 in the current Region. Attach a bucket policy to the S3 bucket that grants access to the VPC private subnets only. Add the gateway prefix list to a NACL to limit access to the application EC2 instances only.

Show Suggested Answer

Suggested Answer: C 🗳️

by wood_wood at Aug. 11, 2020, 2:32 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Nemer

Highly Voted 3 years, 8 months ago

C. S3 endpoint policy to restrict access to specific bucket, bucket policy to grant access to specific VPC endpoint + specific role.

upvoted 20 times

kirrim

3 years, 7 months ago

C is the best answer, I'm not crazy about the wording though. "Only allow access to this role in the S3 bucket's policy" ignores that the very same answer also says the the VPCE needs to be permitted in the bucket policy, too.

upvoted 2 times

...