SAA-C03 Question 229
Single answerA company is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores uploaded user files in an Amazon S3 bucket. Recently, the company noticed an increase in unauthorized attempts to access the S3 bucket directly from the internet. As a solutions architect, how can you secure the S3 bucket to allow access only from the web application?
- A
Create a VPC endpoint for Amazon S3 and configure the bucket to allow access only from the VPC.
- B
Restrict access to the S3 bucket by creating an S3 bucket policy that allows access only from the ALB's public IP address.
- C
Create an S3 bucket policy that allows access only from the ALB using a condition key for the ALB's AWS account ID.
- D
Add a bucket policy that allows access only from the ALB using a condition that requires the
aws:Refererheader to match the application's domain.
Show answer and explanation
Correct answer: C
Explanation
To secure an S3 bucket and allow access only from an ALB, you should use a bucket policy that restricts access based on the ALB's AWS account ID. This approach leverages AWS's native security mechanisms to ensure that only requests originating from the authorized ALB are allowed. Other methods, such as using a VPC endpoint or IP-based policies, are either unnecessary or unsuitable in this context.
- A. Incorrect.
Incorrect. While creating a VPC endpoint can secure access to the S3 bucket from within a VPC, it is not necessary in this scenario since the ALB and S3 can communicate over the internet. The question focuses on securing access to the S3 bucket, not restricting access to the VPC.
- B. Incorrect.
Incorrect. ALBs do not have a fixed public IP address, so it is not possible to use an IP-based bucket policy to restrict access. The ALB's IP addresses can change, making this solution infeasible.
- C. Correct.
Correct. Using the ALB's AWS account ID in the bucket policy ensures that only the web application behind the ALB (which uses the same account) can access the S3 bucket. This is a secure and recommended approach.
- D. Incorrect.
Incorrect. Relying on the
aws:Refererheader is not secure, as headers can be easily spoofed, and it does not provide a robust mechanism to restrict access strictly to the ALB.