SAA-C03 Question 436
Single answerA company is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores user-uploaded images in Amazon S3. The company wants to ensure that only the ALB can access the S3 bucket to retrieve the images. How can this be achieved?
- A
Create an S3 bucket policy that allows access only from the ALB's security group.
- B
Create an S3 bucket policy that restricts access based on the ALB's IP address.
- C
Create an S3 bucket policy that allows access only from the ALB's AWS Service Principal.
- D
Create an S3 bucket policy that allows access based on the ALB's VPC endpoint.
Show answer and explanation
Correct answer: C
Explanation
To restrict access to an S3 bucket so that only an ALB can access it, a bucket policy must be configured to allow access from the ALB's AWS Service Principal. This ensures that requests are validated as coming from the ALB, providing a secure mechanism to control access. Other methods, like using security groups or IP addresses, are not supported or practical for this use case.
- A. Incorrect.
S3 bucket policies do not support security groups as a condition for access control. Therefore, this option is not valid.
- B. Incorrect.
While you can restrict access to an S3 bucket using IP addresses, ALBs do not have fixed IP addresses that you can use for this purpose. This makes this option infeasible.
- C. Correct.
You can create an S3 bucket policy that allows access from the ALB by using the AWS Service Principal associated with the ALB. This ensures that only the ALB can retrieve the images from the S3 bucket.
- D. Incorrect.
VPC endpoints are not related to ALB in this context. While VPC endpoints can restrict access to S3 from within a VPC, it does not specifically target an ALB for access control.