AWS Certified Solutions Architect – Professional — Question 655

A company currently runs a secure application on Amazon EC2 that takes files from on-premises locations through AWS Direct Connect, processes them, and uploads them to a single Amazon S3 bucket. The application uses HTTPS for encryption in transit to Amazon S3, and S3 server-side encryption to encrypt at rest.
Which of the following changes should the Solutions Architect recommend to make this solution more secure without impeding application's performance?

Answer options

• A. Add a NAT gateway. Update the security groups on the EC2 instance to allow access to and from the S3 IP range only. Configure an S3 bucket policy that allows communication from the NAT gateway's Elastic IP address only.
• B. Add a VPC endpoint. Configure endpoint policies on the VPC endpoint to allow access to the required Amazon S3 buckets only. Implement an S3 bucket policy that allows communication from the VPC's source IP range only.
• C. Add a NAT gateway. Update the security groups on the EC2 instance to allow access to and from the S3 IP range only. Configure an S3 bucket policy that allows communication from the source public IP address of the on-premises network only.
• D. Add a VPC endpoint. Configure endpoint policies on the VPC endpoint to allow access to the required S3 buckets only. Implement an S3 bucket policy that allows communication from the VPC endpoint only.

Correct answer: D

Explanation

Using a VPC endpoint for Amazon S3 ensures that data traffic travels entirely within the AWS network, avoiding the public internet and providing better performance and security than a NAT gateway. Restricting access in the S3 bucket policy to the specific VPC endpoint ID (using the aws:sourceVpce condition) is more secure than restricting by IP range, as it prevents unauthorized access from other resources. Options involving a NAT gateway introduce unnecessary cost, latency, and route traffic through public IP spaces.