Q60 — AWS SAP-C02 Ch.2

Question 60 of 75 | ← Chapter 2

Q210. A company is running an application in the AWS Cloud. The application consists of microservices that run on a fleet of Amazon EC2 instances in multiple Availability Zones behind an Application Load Balancer. The company recently added a new RESTAPI that was implemented in Amazon API Gateway. Some of the older microservices that nun on EC2 instances need to call this new API. The company does not want the API to be accessible from the public internet and does not want proprietary data to traverse the public internet. What should a solutions architect do to meet these requirements?

• A. Create an AWS Site-to-Site VPN connection between the VPC and the API Gateway Use API Gateway to generate a unique API key for each microservice. Configure the API methods to require the key.
• B. Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API Add a resource policy to API Gateway to only allow access from the VPC endpoint Change the API Gateway endpoint type to private. ✓
• C. Modify the API Gateway to use IAM authentication. Update the IAM policy for the IAM role that is assigned to the EC2 instances to allow access to the API Gateway. Move the API Gateway into a new VPC Deploy a transit gateway and connect the VPCs
• D. Create an accelerator in AWS Global Accelerator, and connect the accelerator to the API Gateway. Update the route table for all VPC subnets with a route to the created Global Accelerator endpoint IP address. Add an API key for each service to use for authentication.

Correct Answer: B. Create an interface VPC endpoint for API Gateway, and set an endpoint policy to only allow access to the specific API Add a resource policy to API Gateway to only allow access from the VPC endpoint Change the API Gateway endpoint type to private.

Explanation

Option A suggests creating a AWS Site-to-Site VPN connection between the VPC and the API Gateway and generating unique API keys for each microservice, but this approach is complex and adds unnecessary overhead by requiring unique keys for each microservice. Option C suggests modifying the API Gateway to use IAM authentication and updating the IAM policy for the IAM role assigned to the EC2 instances, but this would require additional management of IAM roles and policies, and it does not address the requirement to not make the API accessible over the public internet. Option D suggests creating an accelerator in AWS Global Accelerator and adding an API key for each service to use for authentication, but this does not provide a solution for ensuring that the API is not accessible from the public internet. Therefore, option B provides the most suitable solution by creating an interface VPC endpoint for API Gateway, which will allow the EC2 instances to access the REST API without traversing the public internet or using a NAT gateway. The endpoint policy can be set to only allow access to the specific API, and a resource policy can be added to API Gateway to only allow access from the VPC endpoint. Changing the API Gateway endpoint type to private ensures that it is not accessible from the public internet. These steps provide an efficient and secure way for the microservices running on EC2 instances to access the new REST API implemented in Amazon API Gateway.