A company's security engineer receives an alert that indicates that an unexpected principal is accessing a company-owned Amazon Simple Queue Service (Amazon SQS) queue. All the company's accounts…

Question

Options

• ACreate security groups and attach them to all SQS queues.
• BModify network ACLs in all VPCs to restrict inbound traffic.
• CCreate interface VPC endpoints for Amazon SQS. Restrict access using aws:SourceVpce and
• DUse a third-party cloud access security broker (CASB).

• A
  12% (3)
• B
  4% (1)
• C
  77% (20)
• D
  8% (2)

Explanation

Amazon SQS is a regional service that supports AWS PrivateLink through interface VPC endpoints. According to AWS Certified Security - Specialty documentation, the most secure and compliant way to restrict access to AWS services is by using VPC endpoints combined with resource-based policies. By creating interface VPC endpoints for Amazon SQS in all VPCs, traffic to SQS remains on the AWS network and does not traverse the public internet. Using the aws:SourceVpce condition in the SQS queue policy ensures that only requests originating from approved VPC endpoints can access the queue. Adding the aws:PrincipalOrgId condition further restricts access to principals that belong to the same AWS Organization. Security groups and network ACLs do not apply to SQS because SQS is not deployed inside a VPC. Third-party CASB tools add cost and operational overhead.

No community discussion yet for this question.