SAA-C03 Question 363
Select 4A company is using Amazon Kinesis Data Streams to ingest real-time streaming data from IoT devices deployed in the field. The company wants to ensure secure access to the ingestion endpoints and prevent unauthorized devices from sending data. Which actions should the Solutions Architect recommend?
- A
Use IAM policies to restrict access to the Kinesis Data Stream ingestion endpoint based on device-specific IAM roles.
- B
Implement AWS PrivateLink to create a private endpoint for the Kinesis Data Stream ingestion point.
- C
Use Kinesis Data Streams server-side encryption (SSE) to encrypt data ingested by the devices.
- D
Require all devices to use an API Gateway configured with AWS WAF to authenticate requests before sending data to Kinesis.
- E
Enable VPC endpoint policies for the Kinesis Data Stream to control access from specific VPCs.
Show answer and explanation
Correct answers: A, B, D, E
Explanation
To secure access to ingestion access points, it is critical to implement a combination of IAM policies, private connectivity (such as AWS PrivateLink), request authentication and filtering (via API Gateway and AWS WAF), and VPC endpoint policies. These techniques collectively ensure that only authorized devices and networks can communicate with the Kinesis Data Stream, while server-side encryption protects data at rest but does not directly secure the ingestion access point.
- A. Correct.
Using IAM policies with device-specific IAM roles restricts access to the ingestion endpoint and ensures only authorized devices can send data.
- B. Correct.
AWS PrivateLink allows secure access to the Kinesis ingestion endpoint over a private connection, reducing exposure to the public internet.
- C. Incorrect.
While server-side encryption (SSE) ensures data at rest is encrypted, it does not prevent unauthorized devices from accessing the ingestion endpoint.
- D. Correct.
Requiring devices to authenticate via an API Gateway with AWS WAF can add an extra layer of security by filtering and validating requests before forwarding them to Kinesis.
- E. Correct.
Enabling VPC endpoint policies ensures that only specific VPCs can access the Kinesis Data Stream, further securing access to the ingestion endpoint.