Question

A financial services company runs an internal application on EC2 instances in a private subnet. The application must call the Amazon SQS API without traversing the internet, so the team has created an interface VPC endpoint (powered by AWS PrivateLink) for SQS. Compliance requires that only the two application server security groups be allowed to send API requests through this endpoint, and that all other resources in the VPC be denied. Which configuration correctly enforces this at the network layer?

Accepted Answer

Attach a security group to the interface endpoint's elastic network interfaces that allows inbound HTTPS (TCP 443) only from the two application server security groups.

Answer

Attach an endpoint policy to the interface endpoint that lists the two application server security group IDs in the Principal element.

Answer

Add outbound rules to the two application server security groups referencing the interface endpoint's security group, and rely on the endpoint's implicit deny for all other sources.

Answer

Create a network ACL on the endpoint subnet that permits inbound TCP 443 from the application server subnet CIDR and denies all other traffic.