SAP-C02 Question 517
Select 2A company is running a mission-critical web application on Amazon ECS using the Fargate launch type. The application is integrated with an Amazon RDS database. The company has strict compliance requirements to ensure all traffic between the ECS tasks and the database is encrypted. Additionally, the company must ensure that the ECS tasks can only communicate with the database and not other resources in the VPC. As a solutions architect, which combination of steps should you take to meet these requirements?
- A
Enable encryption in transit for the Amazon RDS database instance and configure the ECS application to use the database's SSL endpoint.
- B
Modify the security group of the RDS database to allow inbound traffic only from the security group associated with the ECS tasks.
- C
Use an AWS WAF web ACL to restrict access between the ECS tasks and the RDS database for added security.
- D
Configure the ECS tasks to use an IAM role that restricts database access only to the RDS instance.
- E
Enable VPC Flow Logs for the VPC to monitor traffic between the ECS tasks and the RDS database.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements, you need to ensure encryption in transit for data between the ECS tasks and the RDS database, which is achieved by enabling SSL for the database and configuring the ECS application to use the SSL endpoint. Additionally, to ensure that the ECS tasks can only communicate with the database, you should use security groups to restrict inbound traffic to the RDS instance specifically to the ECS tasks' security group. WAF, IAM roles, and VPC Flow Logs, while valuable for other use cases, do not address the specific requirements outlined in this scenario.
- A. Correct.
Correct. Enabling encryption in transit for the RDS database ensures that all traffic between the ECS tasks and the database is encrypted. Configuring the ECS application to use the database's SSL endpoint is necessary to enforce this encryption.
- B. Correct.
Correct. Restricting inbound traffic to the RDS database using the security group associated with the ECS tasks ensures that only the ECS application can communicate with the database.
- C. Incorrect.
Incorrect. AWS WAF is used for protecting web applications from common web exploits, not for managing network access within a VPC.
- D. Incorrect.
Incorrect. While IAM roles are important for ECS tasks, they are used to manage permissions for AWS API calls, not to restrict network access to the RDS database.
- E. Incorrect.
Incorrect. VPC Flow Logs provide a way to monitor network traffic, but they do not enforce any security or encryption requirements.