SAA-C03 Question 362
Select 2A company uses Amazon Kinesis Data Streams to ingest real-time data from IoT devices. The data ingestion access points for Kinesis are publicly accessible by default. To ensure secure access to these ingestion endpoints, what combination of actions should you take?
- A
Enable server-side encryption (SSE) for the Kinesis Data Stream.
- B
Use an AWS Identity and Access Management (IAM) policy to restrict access to the Kinesis Data Stream.
- C
Configure a VPC endpoint for Kinesis and ensure access is limited to your VPC.
- D
Enable Kinesis Enhanced Fan-Out to improve security for ingestion access points.
- E
Use AWS WAF to block unwanted traffic to the Kinesis ingestion endpoint.
Show answer and explanation
Correct answers: B, C
Explanation
To secure access to Amazon Kinesis ingestion access points, you should use IAM policies to define who or what can access the Kinesis Data Stream. Additionally, configuring a VPC endpoint for Kinesis restricts access to your private network, ensuring traffic does not traverse the public internet. Other options, like server-side encryption and Enhanced Fan-Out, are beneficial for data security and performance but do not specifically secure access to ingestion endpoints.
- A. Incorrect.
While enabling server-side encryption (SSE) is a good practice for protecting data at rest, it does not directly secure access to the ingestion access points.
- B. Correct.
Using IAM policies is essential to restrict access to authorized users and roles, thereby securing the ingestion access points.
- C. Correct.
Setting up a VPC endpoint for Kinesis ensures that data does not travel over the public internet, enhancing the security of ingestion access points.
- D. Incorrect.
Kinesis Enhanced Fan-Out improves data stream performance by allowing consumers to receive data with low latency, but it does not address security for ingestion access points.
- E. Incorrect.
AWS WAF is typically used to protect web applications from common web exploits, and it does not directly secure Kinesis ingestion endpoints.