SOA-C02 Question 240
Single answerYou are managing a private application hosted in an Amazon VPC that communicates with an AWS service (Amazon S3) without using the public internet. The application runs in an EC2 instance within the private subnet of the VPC. How can you configure this setup to ensure secure communication between the application and the S3 bucket while avoiding internet exposure?
- A
Create a VPC endpoint for S3 and configure the route table of the private subnet to use the endpoint.
- B
Configure a NAT Gateway in the public subnet and update the route table of the private subnet to route traffic through the NAT Gateway.
- C
Use a VPN connection to securely connect the private subnet to the S3 service.
- D
Enable Systems Manager Session Manager on the EC2 instance to access S3 via private connectivity.
Show answer and explanation
Correct answer: A
Explanation
To securely access Amazon S3 from an application in a private subnet without using the public internet, you can use a VPC endpoint for S3. This allows traffic to flow directly between the private subnet and S3 via AWS's internal network, ensuring secure and private communication. Other options either involve the public internet or are not relevant to the use case.
- A. Correct.
Correct. A VPC endpoint for S3 enables private connectivity between your VPC and Amazon S3 without routing traffic through the internet. It is the most secure and efficient solution for this scenario.
- B. Incorrect.
Incorrect. A NAT Gateway allows instances in a private subnet to access the internet, but it does not provide private connectivity to AWS services. This would expose the traffic to the internet, which isn't suitable for this use case.
- C. Incorrect.
Incorrect. A VPN connection is used to connect on-premises environments to AWS or to connect VPCs, but it is not applicable for accessing AWS services like S3 privately within the same region.
- D. Incorrect.
Incorrect. Systems Manager Session Manager is used for securely managing and accessing EC2 instances, not for configuring private connectivity to AWS services like S3.