AWS Certified SysOps Administrator – Associate (legacy) — Question 559

A company needs to restrict access to an Amazon S3 bucket to Amazon EC2 instances in a VPC only. All traffic must be over the AWS private network.
What actions should the SysOps Administrator take to meet these requirements?

Answer options

• A. Create a VPC endpoint for the S3 bucket, and create an IAM policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
• B. Create a VPC endpoint for the S3 bucket, and create a S3 bucket policy that conditionally limits all S3 actions on the bucket to the VPC endpoint as the source.
• C. Create a service-linked role for Amazon EC2 that allows the EC2 instances to interact directly with Amazon S3, and attach an IAM policy to the role that allows the EC2 instances full access to the S3 bucket.
• D. Create a NAT gateway in the VPC, and modify the VPC route table to route all traffic destined for Amazon S3 through the NAT gateway.

Correct answer: B

Explanation

To restrict bucket access to a specific VPC over the private AWS network, you must use a VPC gateway endpoint for S3 and apply an S3 bucket policy with a condition restricting access to that endpoint (using the aws:sourceVpce key). An IAM policy (Option A) applies to users/roles rather than securing the bucket itself from external access. Option D is incorrect because a NAT gateway routes traffic to S3 over public IP addresses rather than keeping the traffic entirely within the AWS private network.