A Developer is building a serverless application that uses Amazon API Gateway as the front end. The application will not be publicly accessible. Other legacy applications running on Amazon EC2 will…

Question

Options

• AConfigure an IAM policy that allows the least permissive actions to communicate with the API
• BEnable AWS WAF for API Gateway Configure rules to explicitly allow connections from the legacy
• CCreate a VPC endpoint for API Gateway Attach an IAM resource policy that allows the role of the
• DCreate a usage plan Generate a set of API keys for each application that needs to call the API.
• EConfigure cross-origin resource sharing (CORS) in each API Share the CORS information with

• A
  75% (18)
• B
  4% (1)
• C
  17% (4)
• D
  4% (1)

Explanation

Note: The stated correct answer of A and E appears to be incorrect. For this scenario - EC2 calling a private, non-public API Gateway - the actual best-practice answer is A and C. CORS (E) is a browser-based security mechanism and is completely irrelevant for server-to-server EC2 calls. The explanation below reflects the correct AWS guidance.

A and C are correct because they address both the authentication layer and the network boundary. Option A enforces least-privilege IAM policies so the EC2 instances can only perform the minimum actions necessary - aligned with the AWS shared responsibility model. Option C creates a VPC endpoint for API Gateway (making it a true private API) and attaches a resource policy scoped to the EC2 role, ensuring no traffic ever traverses the public internet and only authorized roles can invoke the API.

B is wrong because AWS WAF protects against web exploits on publicly exposed APIs; for a private internal API, network-layer controls via VPC endpoints are the correct tool, not WAF rule filtering.

D is wrong because API keys are explicitly not an authentication or authorization mechanism in AWS - they are for throttling and usage tracking only, and relying on them for security creates a false sense of protection.

E is wrong because CORS only applies to browsers enforcing same-origin policy; EC2 processes making direct HTTP/SDK calls are not subject to CORS restrictions at all.

Memory tip: For any "private, internal, EC2-to-API" scenario, think VPC Endpoint + IAM resource policy + least-privilege IAM role - that triad locks down both the network path and the identity layer simultaneously.

No community discussion yet for this question.