SAA-C03 Question 364
Select 2A company is ingesting large volumes of data into an Amazon S3 bucket through an application running on Amazon EC2 instances. The company wants to ensure that access to the S3 bucket is secure and restricted only to the application instances. Which of the following steps should you take to achieve this?
- A
Use an IAM role attached to the EC2 instances to grant permissions to access the S3 bucket.
- B
Create an S3 bucket policy that allows access only from specific VPC endpoints.
- C
Use access keys stored on the EC2 instances to authenticate the application to S3.
- D
Enable server-side encryption on the S3 bucket to secure the data at rest.
- E
Restrict inbound traffic to the EC2 instances using a security group.
Show answer and explanation
Correct answers: A, B
Explanation
To secure access to ingestion access points, such as an Amazon S3 bucket, it is essential to follow AWS security best practices. Attaching an IAM role to the EC2 instances ensures temporary and secure credentials are used, while a bucket policy that restricts access to specific VPC endpoints limits access to trusted network paths. Avoid using static access keys, and while other security measures like encryption and security groups are important, they do not directly address access security to the ingestion endpoint.
- A. Correct.
Correct. Attaching an IAM role to the EC2 instances ensures secure and temporary credentials are used to access the S3 bucket, following AWS best practices.
- B. Correct.
Correct. Using an S3 bucket policy to allow access only through specific VPC endpoints ensures that the data is accessed securely within the company's private network.
- C. Incorrect.
Incorrect. Using access keys stored on the EC2 instances is not a secure approach as it increases the risk of credentials being exposed.
- D. Incorrect.
Incorrect. While enabling server-side encryption on the S3 bucket secures data at rest, it does not control or secure access to the ingestion access point.
- E. Incorrect.
Incorrect. Restricting inbound traffic to EC2 instances using a security group improves instance security but does not specifically secure access to the S3 bucket itself.