SAP-C02 Question 239
Single answerYour organization is deploying a private application hosted on Amazon ECS within a VPC. For security reasons, the application must not access the public internet, but it needs to communicate with Amazon S3 to fetch configuration files and upload logs. Which solution ensures this requirement is met?
- A
Configure a VPC endpoint for Amazon S3 and update the ECS task's IAM role to allow access to the S3 bucket.
- B
Attach an Internet Gateway to the VPC and use a NAT Gateway for the ECS tasks to access Amazon S3.
- C
Set up a VPN connection between the VPC and Amazon S3.
- D
Use VPC peering to connect the VPC with the S3 service.
Show answer and explanation
Correct answer: A
Explanation
The requirement specifies that the application must not access the public internet while still being able to communicate with Amazon S3. A VPC endpoint for S3 enables private connectivity between the VPC and S3, ensuring the data does not traverse the public internet. Additionally, updating the ECS task's IAM role is necessary to grant appropriate permissions to access the S3 bucket.
- A. Correct.
This is correct. A VPC endpoint for S3 allows private communication between resources in a VPC and S3 without needing public internet access. Updating the IAM role ensures the ECS task has the necessary permissions to access S3.
- B. Incorrect.
Incorrect. While a NAT Gateway could provide access to S3, it would require the ECS tasks to go through the public internet, which violates the security requirement of avoiding public internet access.
- C. Incorrect.
Incorrect. VPN connections are used for secure communication between on-premises networks and AWS, not for accessing AWS services like S3 within a VPC.
- D. Incorrect.
Incorrect. VPC peering is used to connect two VPCs for private communication, not for accessing AWS services like S3.