Question

A financial services company runs an application on EC2 instances in a private subnet. The instances access an S3 bucket named 'audit-logs-prod' through a VPC gateway endpoint to keep traffic off the public internet. The security team is concerned that a compromised instance could use the endpoint to exfiltrate data to other S3 buckets in different AWS accounts. Which action MOST effectively limits the endpoint so it can only be used to reach the approved bucket?

Accepted Answer

Attach a VPC endpoint policy to the gateway endpoint that allows S3 actions only on the 'audit-logs-prod' bucket ARN and denies all others

Answer

Add an outbound security group rule on the EC2 instances that permits HTTPS traffic only to the S3 prefix list

Answer

Configure the S3 bucket policy to allow access only from the VPC CIDR range

Answer

Modify the route table to send only the 'audit-logs-prod' bucket's IP addresses through the gateway endpoint