SCS-C03 · Question #132
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2…
The correct answer is A. Update the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and. Amazon S3 gateway endpoints support endpoint policies that can restrict which S3 resources are accessible through the endpoint. According to AWS Certified Security - Specialty documentation, endpoint policies are evaluated in addition to IAM policies and are ideal for enforcing…
Question
A company is using AWS to run a long-running analysis process on data that is stored in Amazon S3 buckets. The process runs on a fleet of Amazon EC2 instances in an Auto Scaling group. The EC2 instances are deployed in a private subnet that does not have internet access. The EC2 instances access Amazon S3 through an S3 gateway endpoint that has the default access policy. Each EC2 instance uses an instance profile role that allows s3:GetObject and s3:PutObject only for required S3 buckets. The company learns that one or more EC2 instances are compromised and are exfiltrating data to an S3 bucket that is outside the company's AWS Organization. The processing job must continue to function. Which solution will meet these requirements?
Options
- AUpdate the policy on the S3 gateway endpoint to allow S3 actions only if aws:ResourceOrgId and
- BUpdate the instance profile role policy to require aws:ResourceOrgId.
- CAdd a network ACL rule to block outbound traffic on port 443.
- DApply an SCP that restricts S3 actions using organization condition keys.
How the community answered
(29 responses)- A83% (24)
- B10% (3)
- C3% (1)
- D3% (1)
Explanation
Amazon S3 gateway endpoints support endpoint policies that can restrict which S3 resources are accessible through the endpoint. According to AWS Certified Security - Specialty documentation, endpoint policies are evaluated in addition to IAM policies and are ideal for enforcing data exfiltration controls without breaking legitimate workloads. By updating the S3 gateway endpoint policy to require both aws:ResourceOrgId and aws:PrincipalOrgId to match the company's AWS Organization, the security engineer ensures that EC2 instances can access only S3 buckets that belong to the organization. This immediately blocks exfiltration to external S3 buckets while allowing legitimate internal data access to continue
Topics
Community Discussion
No community discussion yet for this question.