SAP-C02 Q366 · Networking

Question

A company is using Amazon API Gateway to deploy a private REST API that will provide access to sensitive data. The API must be accessible only from an application that is deployed in a VPC. The company deploys the API successfully. However, the API is not accessible from an Amazon EC2 instance that is deployed in the VPC. Which solution will provide connectivity between the EC2 instance and the API?

Accepted Answer

Option B is correct because it addresses all the requirements for accessing a private API Gateway REST API from within a VPC:

1. **Interface VPC Endpoint for API Gateway**: Private REST APIs in API Gateway are accessed through interface VPC endpoints for the `execute-api` service. This creates private connectivity from the VPC to API Gateway without traversing the internet.

2. **Endpoint Policy with `execute-api:Invoke`**: The VPC endpoint policy should follow the principle of least privilege. The `execute-api:Invoke` action is the specific permission needed to call API Gateway APIs. Using `apigateway:*` (as in option A) grants administrative actions, which is overly permissive and not the correct action namespace for invoking APIs.

3. **Private DNS Enabled**: When private DNS is enable

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips