Answer-first summary for fast verification
Answer: Add an interface VPC endpoint for Kinesis Data Streams to the VPC Ensure that the VPC endpoint policy allows traffic from the applications.
https://docs.aws.amazon.com/vpc/latest/privatelink/vpc-endpoints-access.html When you create an interface endpoint or a gateway endpoint, you can attach an endpoint policy. The endpoint policy controls which AWS principals (AWS accounts, IAM users, and IAM roles) can use the VPC endpoint to access the endpoint service. You cannot attach more than one policy to an endpoint. However, you can modify an endpoint policy at any time. An endpoint policy does not override or replace IAM user policies or service-specific policies (such as S3 bucket policies). If you're using an interface endpoint to connect to Amazon S3, you can also use Amazon S3 bucket policies to control access to buckets from specific endpoints or specific VPCs.
Author: LeetQuiz Editorial Team
Ultimate access to all questions.
No comments yet.
A team collects and routes behavioral data for an entire company. The company runs a Multi-AZVPC environment with public subnets, private subnets, and in internet gateway. Each public subnet also contains a NAT gateway. Most of the company's applications read from and write to Amazon Kinesis Data Streams. Most of the workloads run in private subnets. A solutions architect must review the infrastructure. The solutions architect needs to reduce costs and maintain the function of the applications. The solutions architect uses Cost Explorer and notices that the cost in the EC2- Other category is consistently high. A further review shows that NatGateway-Bytes charges are increasing the cost in the EC2-Other category. What should the solutions architect do to meet these requirements?
A
Enable VPC Flow Logs. Use Amazon Athena to analyze the logs for traffic that can be removed Ensure that security groups are blocking traffic that is responsible for high costs.
B
Add an interface VPC endpoint for Kinesis Data Streams to the VPC Ensure that applications have the correct IAM permissions to use the interface VPC endpoint.
C
Enable VPC Flow Logs and Amazon Detective. Review Detective findings for traffic that is not related to Kinesis Data Streams. Configure security groups to block that traffic.
D
Add an interface VPC endpoint for Kinesis Data Streams to the VPC Ensure that the VPC endpoint policy allows traffic from the applications.