Amazon Web Services SCS-C02 Exam With Confidence Using Practice Dumps

Understanding Gateway VPC Endpoint:

A gateway VPC endpoint allows traffic from the VPC to specific AWS services (e.g., Amazon S3) without traversing the public internet.

Key Configuration Points to Verify:

The route table is correctly configured to send traffic for Amazon S3 through the gateway VPC endpoint.

IAM permissions and bucket policies are correct and allow access to the specific S3 bucket.

Verify the Endpoint Policy:

Check the VPC endpoint policy to ensure it allows access to the S3 bucket. The policy might be restricting access to certain buckets, prefixes, or IAM principals.

Example VPC Endpoint Policy:

{

"Version": "2012-10-17",

"Statement": [

{

"Effect": "Allow",

"Principal": "*",

"Action": "s3:*",

"Resource": [

"arn:aws:s3:::example-bucket",

"arn:aws:s3:::example-bucket/*"

]

}

]

}

Testing and Validation:

Modify the endpoint policy if required and test access again from the EC2 instance.

Gateway VPC Endpoints Documentation

VPC Endpoint Policies for Amazon S3

The correct answer is D.

To implement short-term credentials for third-party AWS accounts, you can use IAM roles and trust policies. A trust policy is a policy document that defines who can assume the role. You can specify the AWS account ID of the third-party account as a principal in the trust policy, and use the sts:ExternalId condition key to enhance the security of the role. The sts:ExternalId condition key is a unique identifier that is agreed upon by both parties and included in the AssumeRole request. This way, you can prevent the “confused deputy” problem, where an unauthorized party can use the same role as a legitimate party.

Option A is incorrect because bearer token authentication with OAuth or SAML is not suitable for granting access to AWS accounts and resources. Amazon Cognito and API Gateway are used for building web and mobile applications that require user authentication and authorization.

Option B is incorrect because AWS IAM Identity Center (AWS Single Sign-On) is a service that simplifies the management of access to multiple AWS accounts and cloud applications for your workforce users. It does not support granting access to third-party AWS accounts.

Option C is incorrect because using AWS Secrets Manager to create a random external key is not necessary and adds operational complexity. You can use the sts:ExternalId condition key instead to provide a unique identifier for each external account.