SAA-C03 Q67 · Security

Question

A company is developing an application in the AWS Cloud. The application's HTTP API contains critical information that is published in Amazon API Gateway. The critical information must be accessible from only a limited set of trusted IP addresses that belong to the company's internal network. Which solution will meet these requirements?

Accepted Answer

**Option B: Create a resource policy for the API that denies access to any IP address that is not specifically allowed.**

Step-by-step reasoning:

1. **Requirement: Restrict HTTP API access to specific trusted IP addresses.** API Gateway resource policies are the native, purpose-built mechanism for IP-based access control on API Gateway endpoints.

2. **How resource policies work:** API Gateway resource policies are JSON-based IAM-like policies that you attach directly to an API. They can include `Condition` blocks with `aws:SourceIp` to explicitly allow or deny requests based on the caller's IP address.

3. **Deny-by-default pattern:** By creating a policy that denies access to any IP not in the trusted list (or equivalently, allows only the trusted IPs and implicitly denies everything e

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips