SCS-C02 Question 110
Select 2An organization is running a web application on Amazon EC2 instances behind an Application Load Balancer (ALB). The application stores sensitive customer data in an Amazon S3 bucket. The organization wants to ensure that all incoming traffic to the web application and the S3 bucket is encrypted, and that access to the S3 bucket is restricted to requests originating only from the ALB. Which combination of actions should the organization take to meet these requirements?
- A
Enable HTTPS on the Application Load Balancer and configure an SSL/TLS certificate.
- B
Create a bucket policy for the S3 bucket that allows access only from the ALB's VPC endpoint.
- C
Configure the S3 bucket policy to allow access only from the ALB by using a condition with the aws:Referer key.
- D
Use an S3 bucket policy with a condition that allows access only from the ALB by using the ALB's public IP address.
- E
Configure a VPC endpoint for S3 and restrict access to the S3 bucket only through this endpoint.
Show answer and explanation
Correct answers: A, E
Explanation
To meet the organization's requirements, HTTPS should be enabled on the ALB with a valid SSL/TLS certificate to ensure encrypted incoming traffic to the web application. Additionally, configuring an S3 bucket policy to restrict access only through a VPC endpoint for S3 ensures that access to the S3 bucket is secure and limited to requests originating within the VPC, including those from the ALB.
- A. Correct.
Correct: Enabling HTTPS on the ALB and configuring an SSL/TLS certificate ensures that all incoming traffic to the web application is encrypted.
- B. Incorrect.
Incorrect: The ALB does not use a VPC endpoint to access S3, so creating a bucket policy for the ALB's VPC endpoint is not a valid method to restrict access.
- C. Incorrect.
Incorrect: Using aws:Referer conditions in bucket policies is not a reliable or secure way to restrict access, as the Referer header can be easily spoofed.
- D. Incorrect.
Incorrect: Restricting access based on the ALB's public IP address is not recommended because the IP addresses of the ALB can change dynamically.
- E. Correct.
Correct: Configuring a VPC endpoint for S3 and restricting access to the S3 bucket only through this endpoint ensures that access is secured and limited to requests from within the VPC, including those originating from the ALB.