Question

A company runs an EC2-based application in private subnets that must read from and write to a specific S3 bucket named 'corp-finance-reports'. Security requirements state that traffic to S3 must not traverse the public internet, and the instances must be prevented from accessing any other S3 bucket, even if application credentials are compromised. A gateway VPC endpoint for S3 has already been created. Which additional configuration BEST enforces these requirements?

Accepted Answer

Attach a VPC endpoint policy to the S3 gateway endpoint that allows S3 actions only on the 'corp-finance-reports' bucket ARN and its objects, denying all other buckets.

Answer

Add an outbound security group rule on the instances allowing HTTPS only to the S3 prefix list, and rely on IAM instance role permissions for bucket scoping.

Answer

Enable S3 Block Public Access on the 'corp-finance-reports' bucket and add a bucket policy requiring the aws:SourceVpc condition.

Answer

Create an interface VPC endpoint for S3 in each private subnet and disable the gateway endpoint so all S3 calls resolve to private IP addresses.