SAA-C03 Question 479
Single answerA company is hosting a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores files uploaded by users in an Amazon S3 bucket. The company wants to ensure that only the ALB can access the S3 bucket to retrieve and serve files. How can this be achieved?
- A
Create a bucket policy for the S3 bucket that allows access only from the ALB's public IP address.
- B
Create a bucket policy for the S3 bucket that allows access only from the ALB's VPC endpoint.
- C
Attach an IAM role to the ALB that grants access to the S3 bucket.
- D
Use an S3 Access Point with a VPC-only restriction and configure the ALB to access it.
Show answer and explanation
Correct answer: B
Explanation
To ensure secure access to an S3 bucket by an ALB, it is best to use a VPC endpoint for S3. A bucket policy can then be configured to allow access only from this VPC endpoint, ensuring that traffic remains within the AWS network and is securely restricted to the load balancer. This approach avoids the challenges of dynamically changing IPs and aligns with AWS best practices for securing S3 access.
- A. Incorrect.
This option is incorrect because ALBs do not have a fixed public IP address; their IPs can dynamically change, making it unsuitable for use in a bucket policy.
- B. Correct.
This is the correct option because you can create a VPC endpoint for Amazon S3 and configure the bucket policy to allow access only from that endpoint. ALBs within the same VPC can securely access the bucket through this endpoint.
- C. Incorrect.
This option is incorrect because IAM roles cannot be directly attached to an ALB. IAM roles are typically used with compute services like EC2, Lambda, or ECS tasks.
- D. Incorrect.
This option is incorrect because while S3 Access Points with VPC-only restrictions can be used to control access to S3, ALBs cannot directly interface with S3 Access Points.