SCS-C02 Question 59
Select 3A company has an application running on Amazon EC2 instances that accesses sensitive data stored in Amazon S3. To comply with security policies, the company requires that all data access from the EC2 instances to the S3 bucket must not traverse the public internet. Additionally, the company wants to implement least privilege access for the EC2 instances. Which combination of actions should you take to meet these requirements?
- A
Create a VPC endpoint for Amazon S3 and update the route table to direct S3 traffic through the endpoint.
- B
Attach an IAM role to the EC2 instances with a policy that grants access to the specific S3 bucket.
- C
Enable encryption on the S3 bucket to protect data at rest.
- D
Configure a NAT gateway to route traffic between the EC2 instances and the S3 bucket.
- E
Use an S3 bucket policy to allow access only from the VPC endpoint.
Show answer and explanation
Correct answers: A, B, E
Explanation
To comply with the requirements, you must ensure that the traffic between the EC2 instances and the S3 bucket does not traverse the public internet. This is achieved by creating a VPC endpoint for Amazon S3 and restricting traffic to the private network. Additionally, applying least privilege access involves attaching an IAM role to the EC2 instances with the necessary permissions and configuring the S3 bucket policy to allow access only from the VPC endpoint. Together, these steps meet the security and compliance requirements.
- A. Correct.
Correct: Creating a VPC endpoint for Amazon S3 ensures that the traffic between the EC2 instances and the S3 bucket does not traverse the public internet.
- B. Correct.
Correct: Attaching an IAM role with a least privilege policy provides the EC2 instances with the necessary permissions to access the specific S3 bucket.
- C. Incorrect.
Incorrect: While enabling encryption on the S3 bucket is a security best practice, it does not address the requirement of avoiding public internet access or implementing least privilege access.
- D. Incorrect.
Incorrect: A NAT gateway is not required in this scenario as the VPC endpoint allows direct communication between the EC2 instances and the S3 bucket without traversing the public internet.
- E. Correct.
Correct: Using an S3 bucket policy to allow access only from the VPC endpoint ensures that the S3 bucket can only be accessed through the private network connection.