SAA-C03 Practice Question 93: S3 VPC Endpoint Policy SourceVpce
AWS Certified Solutions Architect – Associate (SAA-C03) · Test 10 · question 3 of 10
A company runs analytics workloads on EC2 instances in private subnets that have no internet access. The instances reach S3 through a gateway VPC endpoint. A security requirement has two parts: instances in the VPC must be able to reach only the company's own buckets, so that data cannot be copied to a bucket in another AWS account, and the finance-reports bucket must accept requests only when they arrive through this VPC endpoint.
Which combination meets both parts?
Show answer and explanation
Answer:
The two requirements point in opposite directions and each has its own control. An endpoint policy is evaluated on every request that passes through the VPC endpoint, so limiting it to the company's bucket ARNs blocks copies to buckets in other accounts even if a user holds valid credentials for them. In the other direction, the aws:SourceVpce condition key in a bucket policy identifies the endpoint a request came through, so a Deny when it does not match the endpoint ID makes finance-reports unreachable from anywhere else.
Option B fails on both counts. Gateway endpoints do not support security groups, and requests that arrive through a gateway endpoint carry the instance's private IP, which aws:SourceIp does not evaluate for VPC endpoint traffic.
Option C cannot work. Network ACLs filter by IP address and port, S3 addresses are shared by all buckets in the Region, and so the ACL cannot tell one bucket from another. Block Public Access also concerns public policies and ACLs, not which network a request arrives from.
Option D constrains only the role. It does not stop the same credentials, or a different identity, from writing to an outside bucket through the endpoint, and it does not force requests to finance-reports to come through this endpoint.
Reference: Gateway endpoints for Amazon S3