SAA-C03 Question 53
Single answerYou are designing a solution to provide secure access for an application hosted on Amazon EC2 instances within a private VPC subnet. The application needs to access data stored in an Amazon S3 bucket. The solution must ensure that no sensitive credentials are stored on the EC2 instances and minimize network exposure. Which approach should you take?
- A
Attach an IAM role to the EC2 instances with permissions to access the S3 bucket.
- B
Store AWS access keys in a secure file on the EC2 instances to authenticate with S3.
- C
Use a NAT gateway to route traffic from the EC2 instances to the S3 bucket over the Internet.
- D
Configure a VPC endpoint for S3 and attach an IAM role to the EC2 instances with permissions to access the S3 bucket.
Show answer and explanation
Correct answer: D
Explanation
To securely access an S3 bucket from EC2 instances in a private subnet, the best approach is to use an IAM role for authorization and a VPC endpoint for S3 to ensure all traffic stays within the AWS network. This approach adheres to AWS security best practices by avoiding the storage of sensitive credentials and minimizing exposure to the public Internet.
- A. Incorrect.
This is a partial solution as it provides secure access to the S3 bucket via the IAM role but does not minimize network exposure. Data would still flow over the Internet unless additional configurations like a VPC endpoint are introduced.
- B. Incorrect.
This is insecure because storing AWS access keys on the EC2 instance increases the risk of credential compromise. It also violates best practices for credential management.
- C. Incorrect.
Using a NAT gateway increases network exposure as traffic to S3 would traverse the Internet. This does not align with the requirement to minimize network exposure.
- D. Correct.
This is the correct solution as it ensures secure access to the S3 bucket by using an IAM role to provide permissions and minimizes network exposure by routing traffic through a VPC endpoint for S3. This avoids the need for Internet-based communication.