SAA-C03 · Question #117
A company has Amazon EC2 instances in multiple AWS Regions. The instances all store and retrieve confidential data from the same Amazon S3 bucket. The company wants to improve the security of its…
The correct answer is C. Create a VPC endpoint for Amazon S3. Configure an S3 bucket policy to allow connections only. Creating aVPC endpointfor S3 and configuring abucket policyto allow access only from the endpoint ensures that only EC2 instances within the VPC can access the S3 bucket. This solutionimproves security by restricting access at the network level without the need for public…
Question
A company has Amazon EC2 instances in multiple AWS Regions. The instances all store and retrieve confidential data from the same Amazon S3 bucket. The company wants to improve the security of its current architecture. The company wants to ensure that only the Amazon EC2 instances within its VPC can access the S3 bucket. The company must block all other access to the bucket. Which solution will meet this requirement?
Options
- AUse IAM policies to restrict access to the S3 bucket.
- BUse server-side encryption (SSE) to encrypt data in the S3 bucket at rest. Store the encryption
- CCreate a VPC endpoint for Amazon S3. Configure an S3 bucket policy to allow connections only
- DUse AWS Key Management Service (AWS KMS) with customer-managed keys to encrypt the
How the community answered
(39 responses)- A3% (1)
- B8% (3)
- C77% (30)
- D13% (5)
Explanation
Creating aVPC endpointfor S3 and configuring abucket policyto allow access only from the endpoint ensures that only EC2 instances within the VPC can access the S3 bucket. This solutionimproves security by restricting access at the network level without the need for public internet access. Option A (IAM policies): IAM policies alone cannot restrict access based on the network location. Option B and D (Encryption): Encryption secures data at rest but does not restrict network access
Community Discussion
No community discussion yet for this question.