A VPC application accesses S3 and an AI service.
Restrict allowed resources even over private routes.
Choose two appropriate practices.
Limit endpoint actions, resources, and principals and combine endpoint, IAM, resource, network, and audit controls.
Detailed explanation
Private connectivity does not make every operation acceptable.
Private connectivity does not make every operation acceptable.
Authorization and route controls are layered.
Authorization and route controls are layered.
The allowed scope is still too broad.
The allowed scope is still too broad.
Misconfiguration and unauthorized changes cannot be traced.
Misconfiguration and unauthorized changes cannot be traced.
Try it yourself
An example you can run in a temporary verification environment.
AWS公式VPCエンドポイントポリシー・IAMとAIF-C01 Domain 5.1を確認する。Expected result
ネットワーク経路と各認可ポリシーの役割を説明できる。Key points
- Endpoint policy
- IAM
- Least privilege
Notes
- Environment: AWS公式AIF-C01試験ガイドとAWS公式ドキュメントの確認
- Command output formatting can vary slightly by distribution or tool version.
- Run the example in a temporary directory or process when possible.
Foundation review
Read the scope first
Check whether the command acts on the current shell, a new process, an existing process, or a file.
Verify the observable result
Use the supplied command and compare the output with the expected result.