SAA-C03 Question 361
Select 3A company is using Amazon Kinesis Data Streams to process real-time data from IoT devices. To ensure secure access to the ingestion access points, what actions should the company take?
- A
Use AWS Identity and Access Management (IAM) policies to grant least privilege permissions to users and applications.
- B
Enable server-side encryption (SSE) with Kinesis-managed encryption keys (SSE-KMS).
- C
Use a security group to restrict access to the Kinesis Data Streams ingestion endpoint by IP address.
- D
Implement VPC endpoints for Kinesis Data Streams to ensure private access without traversing the public internet.
- E
Enable Multi-Factor Authentication (MFA) for all users accessing Kinesis Data Streams.
Show answer and explanation
Correct answers: A, B, D
Explanation
To secure access to ingestion access points for Amazon Kinesis Data Streams, you should use IAM policies to enforce least privilege access, enable server-side encryption to protect data, and use VPC endpoints to ensure private connectivity. Security groups do not apply to Kinesis, and while MFA enhances identity security, it does not directly secure the ingestion access points.
- A. Correct.
Correct. Using IAM policies to grant least privilege permissions ensures that only authorized users and applications can access the Kinesis Data Streams ingestion access points.
- B. Correct.
Correct. Enabling server-side encryption (SSE) with Kinesis-managed encryption keys (SSE-KMS) protects data at rest in the streams.
- C. Incorrect.
Incorrect. Security groups are used for EC2 instances and resources within a VPC, but they cannot restrict access to Kinesis Data Streams, which do not directly use security groups.
- D. Correct.
Correct. Implementing VPC endpoints allows secure access to Kinesis Data Streams within a VPC without exposing traffic to the public internet.
- E. Incorrect.
Incorrect. While enabling MFA is a good security practice for user access, it does not directly secure the ingestion access points of Kinesis Data Streams.