Explanation

Correct Answers: A and D

A. Attach an IAM role that has sufficient privileges to the EKS pod. - This is correct because:

1. EKS pods should use IAM roles for service accounts (IRSA) to securely access AWS services
2. IAM roles provide temporary credentials that rotate automatically, which is more secure than static credentials
3. This follows AWS security best practices for containerized applications

D. Create a VPC endpoint for DynamoDB. - This is correct because:

1. VPC endpoints (specifically Gateway VPC endpoints for DynamoDB) allow private connectivity between the VPC and DynamoDB
2. Traffic stays within the AWS network and doesn't go over the internet
3. This enables the application in private subnets to access DynamoDB without internet connectivity

Why other options are incorrect:

B. Attach an IAM user that has sufficient privileges to the EKS pod. - Incorrect because:

1. IAM users are for human or programmatic access, not recommended for EKS pods
2. Requires managing long-term credentials which is a security risk
3. EKS pods should use IAM roles with IRSA instead

C. Allow outbound connectivity to the DynamoDB table through the private subnets' network ACLs. - Incorrect because:

1. Network ACLs control traffic at the subnet level, but this doesn't solve the internet exposure issue
2. Even with outbound rules, traffic would still go over the internet without a VPC endpoint
3. This approach would expose traffic to the internet, violating the requirement

E. Embed the access keys in the Java Spring Boot code. - Incorrect because:

1. Hardcoding credentials in application code is a major security anti-pattern
2. Credentials can be exposed in source control, logs, or during debugging
3. Makes credential rotation difficult and increases security risks

Key Concepts:

1. IRSA (IAM Roles for Service Accounts): Allows EKS pods to assume IAM roles using OpenID Connect
2. VPC Endpoints for DynamoDB: Gateway endpoints that route DynamoDB traffic through AWS private network
3. Private Subnets: Subnets without internet gateways, requiring VPC endpoints for AWS service access

Architecture Design:

• EKS pod → IAM role (via IRSA) → VPC endpoint → DynamoDB
• All traffic stays within AWS network, no internet exposure