A company wants to restrict access to an Amazon S3 bucket so that only requests originating from a specific Amazon Virtual Private Cloud (VPC) are allowed. <br/><br/>Which TWO actions must a solutions architect take to meet this requirement? (Select TWO.)

Answer options:

Create a VPC endpoint for Amazon S3 in the VPC.

Create a NAT gateway in a public subnet.

Add a bucket policy to the S3 bucket that denies access unless the aws:sourceVpce condition matches the VPC endpoint.

Configure an IAM policy for the EC2 instances to allow S3 access.

Modify the S3 bucket ACL to only allow the VPC CIDR block.

How to approach this question

Identify how to connect a VPC privately to S3 and how to enforce that connection on the bucket.

Full Answer

To restrict S3 bucket access to a specific VPC, you must create a VPC endpoint for S3 and then attach a bucket policy that uses the aws:sourceVpce condition key to deny access from any other source.

Common mistakes

Thinking IAM policies alone can secure the bucket from external access.

Question 05 All questions Question 07

Practice the full AWS SAA-C03 Practice Exam 6

65 questions · hints · full answers · grading

More questions from this exam

Q01A company has multiple AWS accounts in an AWS Organizations organization. The security team wants...Medium Q02A company has two AWS accounts: Account A for development and Account B for production. Developer...Medium Q03A mobile application needs to authenticate users using their social media accounts (Facebook, Goo...Easy Q04A company is running an application on Amazon EC2 instances. The application needs to connect to ...Medium Q05A company has 50 AWS accounts managed by AWS Organizations. The IT team wants to implement a cent...Easy

View all 65 questions →