AWS Certified Solutions Architect - Associate
Get started today
Ultimate access to all questions.
Deep dive into the quiz with AI chat providers.
We prepare a focused prompt with your quiz and certificate details so each AI can offer a more tailored, in-depth explanation.
A business application is hosted on Amazon EC2 and uses Amazon S3 for encrypted object storage. The chief information security officer has directed that no application traffic between the two services should traverse the public internet.
Which capability should the solutions architect use to meet the compliance requirements?
Other
Community
UAnonymous
A
AWS Key Management Service (AWS KMS)
B
VPC endpoint
C
Private subnet
D
Virtual private gateway
Explanation:
Explanation
VPC endpoints (specifically VPC endpoints for S3) are the correct solution for this requirement because:
-
Traffic stays within AWS network: VPC endpoints for S3 allow EC2 instances in a VPC to access S3 without traversing the public internet. The traffic remains within the AWS network infrastructure.
-
Security compliance: This meets the CISO's requirement that "no application traffic between the two services should traverse the public internet."
-
Direct connectivity: VPC endpoints provide a direct, private connection between your VPC and AWS services like S3.
Why the other options are incorrect:
-
A. AWS Key Management Service (AWS KMS): This is for encryption key management, not for network routing. While S3 encryption might use KMS, this doesn't address the network traffic requirement.
-
C. Private subnet: Private subnets prevent internet access for EC2 instances, but traffic from a private subnet to S3 would still go through the internet gateway and traverse the public internet unless a VPC endpoint is used.
-
D. Virtual private gateway: This is for connecting your VPC to on-premises networks via VPN or Direct Connect, not for accessing AWS services privately.
Additional context:
- There are two types of VPC endpoints: Interface endpoints (powered by AWS PrivateLink) for most AWS services, and Gateway endpoints specifically for S3 and DynamoDB.
- For S3, you would use a Gateway endpoint which doesn't require ENIs and is free to use.
- This solution ensures that data transfer between EC2 and S3 remains secure and compliant with the organization's security policies.
Comments
Loading comments...