A logistics firm runs its warehouse data pipeline on EC2 instances in private subnets, with no internet gateway or NAT gateway. The instances reach Amazon S3 through a gateway VPC endpoint, and they must read and write only the firm's three production buckets.
Security is concerned that a compromised instance could copy data through the endpoint to a bucket in another account, and that stolen credentials could be used to read the production buckets from outside the VPC. The solution must add no hourly endpoint charges.
Which TWO changes meet these requirements? (Choose two.)
Choose two answers.
AA. Attach a security group to the S3 gateway endpoint that allows outbound HTTPS only to the company's bucket IP ranges. The security group then filters the endpoint traffic by destination bucket.
BB. Attach an endpoint policy to the S3 gateway endpoint that allows S3 actions only on the three production bucket ARNs and their objects.
CC. Add a condition to each production bucket policy that allows requests only when aws:SourceVpce matches the S3 gateway endpoint ID, and deny requests that arrive from anywhere else.
DD. Replace the gateway endpoint with an interface endpoint for S3, and attach a security group that allows HTTPS from the subnets. The security group then limits which buckets the instances can reach through the endpoint.
EE. Give each instance role an IAM policy that lists only the three production buckets, and remove the endpoint policy. The role policies are enough, because the instances are the only callers inside the VPC.
Show the answer and explanation
Answers: B, C
A. Wrong: Gateway endpoints do not use security groups, and S3 does not publish IP ranges for individual buckets. This option describes a control that does not exist for this endpoint type.
B. Right: Correct. The endpoint policy filters every S3 request that enters the VPC through this endpoint, so requests for other buckets are denied whatever the caller permissions. The endpoint stays a gateway endpoint, so there is no hourly charge. Learn more: Gateway endpoints for Amazon S3 (opens in a new tab)
C. Right: Correct. A bucket policy with aws:SourceVpce means the company buckets accept requests only through this endpoint, which blocks direct access from outside the VPC. Together with the endpoint policy, it covers both directions of copying. Learn more: Controlling access to VPC endpoints (opens in a new tab)
D. Wrong: Interface endpoints do use security groups, but the group controls network access to the endpoint, not which buckets can be reached. Bucket limits still need an endpoint policy, and interface endpoints add hourly charges.
E. Wrong: Role policies restrict the instance roles, but any principal that holds other valid credentials, or a role with broader permissions, can still reach other buckets through the endpoint. The endpoint itself would not check the destination bucket.
Explanation
An S3 gateway endpoint policy limits which buckets can be reached through the endpoint, and a bucket policy with aws:SourceVpce limits which requests the buckets accept from the VPC. Security groups do not apply to gateway endpoints, and interface endpoints add cost while still needing an endpoint policy for bucket limits.
The endpoint policy limits which buckets the VPC can reach, and aws:SourceVpce in each bucket policy limits who can reach the bucket.
Want more on Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN)? The 5 full-length practice sets have 6 more Private access to services (VPC endpoints, endpoint policies, PrivateLink, Client VPN) questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →