SOA-C02 · Question #131
A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps…
The correct answer is B. Attach an S3 gateway endpoint to the VPC. S3 Gateway Endpoints allow private connections between your VPC and Amazon S3, without needing to traverse the internet. This ensures that traffic between your private subnet and S3 does not leave the Amazon network, adhering to best security practices. By attaching the S3…
Question
A company has a VPC with public and private subnets. An Amazon EC2 based application resides in the private subnets and needs to process raw .csv files stored in an Amazon S3 bucket. A SysOps administrator has set up the correct IAM role with the required permissions for the application to access the S3 bucket, but the application is unable to communicate with the S3 bucket. Which action will solve this problem while adhering to least privilege access?
Options
- AAdd a bucket policy to the S3 bucket permitting access from the IAM role.
- BAttach an S3 gateway endpoint to the VPC.
- CConfigure the route table to allow the instances on the private subnet access through the
- DCreate a NAT gateway in a private subnet and configure the route table for the private
How the community answered
(25 responses)- A4% (1)
- B84% (21)
- C4% (1)
- D8% (2)
Explanation
S3 Gateway Endpoints allow private connections between your VPC and Amazon S3, without needing to traverse the internet. This ensures that traffic between your private subnet and S3 does not leave the Amazon network, adhering to best security practices. By attaching the S3 gateway endpoint to the VPC and configuring the route table for the private subnet, you can ensure that the application in the private subnet can securely access the S3 This approach adheres to least privilege access, as it does not require the use of internet-facing resources like a NAT Gateway or an Internet Gateway, which could expose the application to unnecessary access.
Topics
Community Discussion
No community discussion yet for this question.