AWS Certified Security – Specialty — Question 88

A corporate cloud security policy states that communications between the company's VPC and KMS must travel entirely within the AWS network and not use public service endpoints.
Which combination of the following actions MOST satisfies this requirement? (Choose two.)

Answer options

• A. Add the aws:sourceVpce condition to the AWS KMS key policy referencing the company's VPC endpoint ID.
• B. Remove the VPC internet gateway from the VPC and add a virtual private gateway to the VPC to prevent direct, public internet connectivity.
• C. Create a VPC endpoint for AWS KMS with private DNS enabled.
• D. Use the KMS Import Key feature to securely transfer the AWS KMS key over a VPN.
• E. Add the following condition to the AWS KMS key policy: "aws:SourceIp": "10.0.0.0/16".

Correct answer: A, C

Explanation

Options A and C are correct because they ensure that communications with AWS KMS are routed through the private VPC endpoint, thus maintaining compliance with the security policy. Option B, while enhancing security, does not directly address the requirement of using the AWS network for KMS communication. Option D does not meet the requirement as it involves transferring keys over a VPN, which is not necessary with the use of VPC endpoints. Option E restricts access based on IP address but does not ensure traffic stays within the AWS network.