Q27 — AWS SAA-C03 Ch.11

Question 27 of 100 | ← Chapter 11

Q727. A company has an application that runs on Amazon EC2 instances in a private subnet. The application needs to process sensitive information from an Amazon S3 bucket. The application must not use the internet to connect to the S3 bucket.Which solution will meet these requirements?

Correct Answer: D. Configure a VPC endpoint. Update the S3 bucket policy to allow access from the VPC endpoint. Update the application to use the new VPC endpoint.

Explanation

To meet the requirement of allowing an application running on EC2 instances in a private subnet to access an S3 bucket without using the internet, the most suitable solution is:D. Configure a VPC endpoint. Update the S3 bucket policy to allow access from the VPC endpoint. Update the application to use the new VPC endpoint.Option D, configuring a VPC endpoint, updating the S3 bucket policy to allow access from the VPC endpoint, and updating the application to use the new VPC endpoint, is the recommended solution to meet the requirements:- VPC endpoint: A VPC endpoint enables private communication between a VPC and supported AWS services. In this case, you would configure an S3 VPC endpoint.By configuring a VPC endpoint for S3, the EC2 instances in the private subnet can securely access the S3 bucket without using the internet. The traffic between the EC2 instances and S3 remains within the AWS network.To ensure that only the EC2 instances with the VPC endpoint can access the S3 bucket, you would update the S3 bucket policy to allow access from the VPC endpoint. This restricts access to only the specified VPC and prevents unauthorized access.Finally, you would update the application running on the EC2 instances to use the new VPC endpoint. This ensures that the application communicates with S3 through the VPC endpoint, maintaining a secure and private connection.Option A, configuring an internet gateway and updating the S3 bucket policy to allow access from the internet gateway, goes against the requirement of not using the internet to connect to the S3 bucket.Option B, configuring a VPN connection and updating the S3 bucket policy to allow access from the VPN connection, is not the most straightforward solution for this scenario. VPN connections are typically used for secure connectivity between on-premises networks and VPCs, and setting up a VPN connection adds unnecessary complexity.Option C, configuring a NAT gateway and updating the S3 bucket policy to allow access from the NAT gateway, is not the appropriate solution for accessing an S3 bucket from within a VPC. NAT gateways are primarily used for enabling outbound internet connectivity from private subnets, and they are not designed for accessing S3 within the VPC.Therefore, the solution that best meets the requirements is D: Configure a VPC endpoint, update the S3 bucket policy to allow access from the VPC endpoint, and update the application to use the new VPC endpoint. This solution ensures that the application can securely process sensitive information from the S3 bucket without relying on the internet.