Q47 — AWS SAA-C03 Ch.14

Question 47 of 100 | ← Chapter 14

Q1047. A company runs its legacy web application on AWS. The web application server runs on an Amazon EC2 instance in the public subnet of a VPC. The web application server collects images from customers and stores the image files in a locally attached Amazon Elastic Block Store (Amazon EBS) volume. The image files are uploaded every night to an Amazon S3 bucket for backup.A solutions architect discovers that the image files are being uploaded to Amazon S3 through the public endpoint. The solutions architect needs to ensure that traffic to Amazon S3 does not use the public endpoint.Which solution will meet these requirements?

Correct Answer: A. Create a gateway VPC endpoint for the S3 bucket that has the necessary permissions for the VPC.Configure the subnet route table to use the gateway VPC endpoint.

Explanation

To ensure that traffic from the web application server to Amazon S3 does not use the public endpoint, the best solution is:A. Create a gateway VPC endpoint for the S3 bucket that has the necessary permissions for the VPC. Configure the subnet route table to use the gateway VPC endpoint.Explanation:\1. Gateway VPC Endpoint for S3: - A gateway VPC endpoint allows you to privately connect your VPC to supported AWS services, including Amazon S3, without requiring access over the public internet. This means that traffic between the EC2 instance and the S3 bucket will stay within the AWS network.\2. Security and Performance: - Using a VPC endpoint enhances security by keeping traffic off the public internet and can improve performance due to reduced latency and increased reliability.\3. Permissions: - When creating the VPC endpoint, you can set up the necessary IAM policies to ensure that only authorized resources within the VPC can access the S3 bucket.Evaluation of Other Options:B. Move the S3 bucket inside the VPC: - S3 is a regional service that cannot be moved inside a VPC. S3 buckets exist outside of VPCs, so this option is not feasible.C. Create an Amazon S3 access point for the Amazon EC2 instance inside the VPC: - While S3 access points provide a way to manage data access, they do not inherently change the way traffic is routed to S3. The traffic could still go through the public endpoint unless a VPC endpoint is used.D. Configure an AWS Direct Connect connection: - AWS Direct Connect provides a dedicated network connection but is typically used for hybrid environments connecting on-premises data centers to AWS. It is more complex and costly for simply routing traffic to S3 from within the same AWS region, and it does not directly address the requirement for avoiding public endpoints.Conclusion:Option A is the most efficient and straightforward solution to ensure that traffic to Amazon S3 does not use the public endpoint while maintaining security and simplicity.