A company is designing a serverless application to process a large number of events within an AWS account. The application saves the events to a data warehouse for further analysis. The application…

Question

Options

• ACreate a VPC endpoint for Amazon SQS. Set the queue policy to deny all access except from the
• BConfigure server-side encryption with SQS-managed keys (SSE-SQS).
• CConfigure AWS Security Token Service (AWS STS) to generate temporary credentials for
• DConfigure VPC Flow Logs to detect SQS traffic that leaves the VPC.

• A
  74% (32)
• B
  7% (3)
• C
  14% (6)
• D
  5% (2)

Explanation

Amazon SQS supports Interface VPC endpoints (AWS PrivateLink), enabling private connectivity from your VPC to SQS without using public IPs, traversing the public Internet, or requiring NAT/IGW. You can restrict access by attaching a queue resource policy that allows only the specific VPC endpoint and denies all other principals/paths, enforcing that all traffic stays on the AWS network. SSE-SQS (B) encrypts data at rest but does not influence network pathing. STS temporary credentials (C) handle authentication/authorization, not routing. VPC Flow Logs (D) are monitoring/visibility and do not prevent public egress. Creating an SQS VPC endpoint and tightening the queue policy satisfies the requirement of no public IP usage while maintaining secure, private access from serverless components in VPC subnets.

No community discussion yet for this question.