A VPC application accesses S3 and an AI service.
Restrict allowed resources even over private routes.
Choose two appropriate practices.
Limit endpoint actions, resources, and principals and combine endpoint, IAM, resource, network, and audit controls.
Detailed explanation
Authorization and route controls are layered.
Private connectivity does not make every operation acceptable.
Misconfiguration and unauthorized changes cannot be traced.
The allowed scope is still too broad.
Check official documentation
Compare the following points with the official documentation.
AWS公式VPCエンドポイントポリシー・IAMとAIF-C01 Domain 5.1を確認する。
Official references
What to confirm
ネットワーク経路と各認可ポリシーの役割を説明できる。
Key points
- Endpoint policy
- IAM
- Least privilege
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Compare the definition with the AIF-C01 objective and the service documentation before applying it.
- Keep the concept separate from a particular answer choice or implementation step.
Foundation review
VPC endpoint policy
A policy that limits operations and resources reachable through a VPC endpoint.
Resource policy
A policy attached to a resource that controls which principals and conditions may access it.