AWS Certified Solutions Architect Professional · Free Practice Question Hard
Question 2
A financial services company is building a hybrid Payment Card Industry Data Security Standard (PCI-DSS) compliant application that runs in the us-east-1 Region as well as on-premises. The application sends access logs from all locations to a single S3 bucket in the us-east-1 Region. To protect this sensitive data, the bucket policy is configured to deny access from public IP addresses.
As an AWS Certified Solutions Architect Professional, how would you configure the network to meet these requirements?
-
A
Set up an AWS Site-to-Site VPN connection to the company's VPC in us-east-1 and use BGP to advertise routes for S3
-
B
Create a private virtual interface to a Direct Connect connection in us-east-1. Set up an interface VPC endpoint and configure the on-premises systems to access S3 via this endpoint
-
C
Create a public virtual interface to a Direct Connect connection in us-east-1. Leverage an on-premises HTTPS proxy to send traffic to S3 over a Direct Connect connection
-
D
Set up a VPN connection to the company's VPC in us-east-1. Create a NAT gateway and configure the on-premises systems to leverage an HTTPS proxy in the VPC to access Amazon S3
Reveal correct answer
Correct answer: B
Explanation
Correct option:
Create a private virtual interface to a Direct Connect connection in us-east-1. Set up an interface VPC endpoint and configure the on-premises systems to access S3 via this endpoint
You can establish access to Amazon S3 from your on-premises network via Direct Connect in the following ways:
Use a public IP address over Direct Connect
Use a private IP address over Direct Connect (with an interface VPC endpoint)
To access S3 using a private IP address over Direct Connect, you can create a private virtual interface for your connection and then create an interface VPC endpoint for S3 in your VPC that is associated with the virtual private gateway. The VGW must connect to a Direct Connect private virtual interface. This interface VPC endpoint resolves to a private IP address even if you enable a VPC endpoint for S3. When you access Amazon S3, you need to use the same DNS name provided under the details of the VPC endpoint.
Incorrect options:
Create a public virtual interface to a Direct Connect connection in us-east-1. Leverage an on-premises HTTPS proxy to send traffic to S3 over a Direct Connect connection - To connect to S3 using a public IP address over Direct Connect, you can create a public virtual interface for your connection. After the BGP is up and running, the Direct Connect router advertises all global public IP prefixes, including S3 prefixes. Traffic heading to S3 is routed through the Direct Connect public virtual interface. The public virtual interface is routed through a private network connection between AWS and your data center or corporate network. Since the given use case prohibits using public IP addresses, so this option is incorrect.
Set up an AWS Site-to-Site VPN connection to the company's VPC in us-east-1 and use BGP to advertise routes for S3 - A VPN connection refers to the connection between your VPC and your own on-premises network. Site-to-Site VPN supports Internet Protocol security (IPsec) VPN connections. VPN connection would establish on-premises connectivity with the VPC. You will still need a VPC endpoint to access S3 from within the VPC. The reference to BGP advertising routes for S3 is a distractor.
Set up a VPN connection to the company's VPC in us-east-1. Create a NAT gateway and configure the on-premises systems to leverage an HTTPS proxy in the VPC to access Amazon S3 - A NAT gateway is a Network Address Translation (NAT) service. You can use a NAT gateway so that instances in a private subnet can connect to services outside your VPC but external services cannot initiate a connection with those instances. You cannot use a NAT gateway with a VPN connection to facilitate access to S3. This option has been added as a distractor.
Reference:
https://aws.amazon.com/premiumsupport/knowledge-center/s3-bucket-access-direct-connect/
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
