SAA-C03 Q278 · Networking

Question

A company has Amazon EC2 instances in multiple AWS Regions. The instances all store and retrieve confidential data from the same Amazon S3 bucket. The company wants to improve the security of its current architecture. The company wants to ensure that only the Amazon EC2 instances within its VPC can access the S3 bucket. The company must block all other access to the bucket. Which solution will meet this requirement?

Accepted Answer

**Option C: Create a VPC endpoint for Amazon S3. Configure an S3 bucket policy to allow connections only from the endpoint.**

This solution precisely addresses both requirements:

1. **Requirement: Only EC2 instances within VPCs can access S3** → A VPC Gateway Endpoint for S3 creates a private pathway from the VPC to S3 without traversing the public internet. Traffic stays within AWS's private network.

2. **Requirement: Block all other access** → An S3 bucket policy with a `aws:sourceVpce` condition key can explicitly deny all requests that do NOT originate from the specified VPC endpoint(s). This means even users with valid IAM credentials cannot access the bucket unless their request flows through the VPC endpoint.

The bucket policy would look like:
```json
{
  "Effect": "Deny",
  "Pr

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips