Determine security controls based on requirements

Silverbirch Capital runs a risk engine on Amazon EC2 instances in private subnets of the VPC vpc-risk. The instances read and write the bucket risk-results through a NAT gateway today. The security team requires that the instances reach Amazon S3 without traversing the internet, that the instances be unable to copy data to any S3 bucket outside the company's AWS organization, and that risk-results accept requests only when they arrive from vpc-risk.

Which solution meets these requirements?

1. AKeep the NAT gateway and add an outbound security group rule that allows HTTPS only to the S3 managed prefix list.Traffic through a NAT gateway still uses public S3 endpoints over the internet path, and the prefix list includes every bucket in the Region, so exfiltration to external buckets remains possible.
2. BCreate an S3 gateway endpoint in vpc-risk with an endpoint policy that allows S3 actions only on resources whose aws:ResourceOrgID matches the company's organization ID, and add a bucket policy on risk-results that denies requests unless aws:SourceVpce equals the endpoint ID.The endpoint policy limits which buckets can be reached through the endpoint, blocking copies to buckets outside the organization. The bucket policy condition on aws:SourceVpce ensures risk-results rejects requests that do not come through the endpoint in vpc-risk.
3. CCreate an S3 gateway endpoint with the default full-access endpoint policy and add a bucket policy on risk-results that allows access only from the private IP range of vpc-risk using aws:SourceIp.The default endpoint policy allows access to any bucket, so data could be copied outside the organization. Requests through a VPC endpoint carry private addresses, and aws:SourceIp does not match them; aws:VpcSourceIp or aws:SourceVpce must be used instead.
4. DAttach a service control policy that denies s3:PutObject for all buckets outside the organization and remove the NAT gateway route.Removing the NAT route without adding an endpoint cuts off S3 access entirely. An SCP also restricts only principals in the organization, not credentials from another account used on these instances.

Harrowgate Insurance has 1,800 Amazon EC2 instances running Amazon Linux 2023 and Windows Server across 25 accounts and three Regions in AWS Organizations. The corporate standard says security patches classified as Critical or Important must be installed within 14 days of release, but only after they have been available for 7 days so that test environments see them first. Instances must be scanned daily, patched only during a Saturday night window, and compliance must be reported centrally. The team wants to minimize administrative effort.

Which solution meets these requirements?

1. AEnable Amazon Inspector across the organization and configure it to install missing patches it detects on Saturday nights.Amazon Inspector detects software vulnerabilities and reports findings, but it does not install patches.
2. BUse the predefined AWS patch baselines and create a maintenance window in each account and Region that runs AWS-RunPatchBaseline with the Install operation every day.Running the Install operation every day installs patches outside the Saturday night window, and creating and maintaining 75 separate maintenance windows across accounts and Regions by hand is high administrative effort with no organization-wide policy to keep new accounts and Regions consistent.
3. CBuild a new golden AMI every week with EC2 Image Builder and replace all instances on Saturday nights.Image Builder is useful for immutable fleets, but replacing 1,800 long-lived instances weekly is disruptive and does not provide daily compliance scanning of running instances.
4. DCreate a patch policy with AWS Systems Manager Quick Setup for the organization that uses custom patch baselines approving Critical and Important security patches 7 days after release, a daily scan schedule, and a weekly Saturday night install schedule.Quick Setup patch policies deploy patching configuration across accounts and Regions in an organization, with separate scan and install schedules. A custom baseline with a 7-day auto-approval delay implements the test-first rule, and Patch Manager reports compliance centrally.

Duncairn Energy stores the credentials for an Amazon RDS for PostgreSQL database named meter-db in AWS Secrets Manager and has enabled automatic rotation every 30 days. The rotation AWS Lambda function runs in the same private subnets as meter-db so it can connect to the database. The VPC has no NAT gateway or internet gateway by policy. Every rotation attempt fails with a timeout at the step where the function calls Secrets Manager. The security team also wants the Secrets Manager traffic from the VPC restricted to secrets in the company's account.

Which solution will allow rotation to succeed while meeting the security requirements?

1. AAdd a NAT gateway to a new public subnet and route the Lambda subnets through it.A NAT gateway would let the function reach the public Secrets Manager endpoint, but it violates the policy of no internet path and does not restrict which secrets can be accessed.
2. BMove the rotation function out of the VPC so that it can reach Secrets Manager, and connect to meter-db through its public endpoint.Making the database publicly accessible to support rotation weakens security significantly and contradicts the private network design.
3. CCreate an interface VPC endpoint for Secrets Manager in the Lambda subnets with private DNS enabled, allow HTTPS from the function's security group in the endpoint's security group, and attach an endpoint policy that limits access to secrets in the company's account.The rotation function calls the Secrets Manager API to get and update secret versions. An interface endpoint with private DNS lets those calls resolve to private IP addresses in the VPC, the security group rule allows the traffic, and the endpoint policy restricts which secrets can be used through it.
4. DCreate an S3 gateway endpoint in the VPC and store the new password in an S3 object that the function reads during rotation.Gateway endpoints exist only for Amazon S3 and DynamoDB. The rotation process must call the Secrets Manager API, so an S3 workaround does not fix the timeout and adds an unsafe copy of the password.

Westermere Pharma's application encrypts patient consent records on the client side with AWS KMS before storing them in an Amazon DynamoDB global table that replicates between us-east-1 and eu-west-1. The application in each Region must be able to decrypt any record locally, even if KMS in the other Region is unavailable, and the compliance team wants a single logical key with the same key material in both Regions so ciphertext does not need to be re-encrypted during replication. All traffic between the application and AWS services must use TLS.

Which encryption design meets these requirements?

1. ACreate a KMS multi-Region primary key in us-east-1, replicate it to eu-west-1 as a multi-Region replica key, and have each Regional application call its local key through the HTTPS AWS SDK endpoints.Multi-Region keys share key material and key ID across Regions, so data encrypted in one Region can be decrypted in the other by the local replica key without calling another Region. AWS SDK calls to KMS and DynamoDB use TLS.
2. BCreate a separate customer managed KMS key in each Region and re-encrypt each record with the eu-west-1 key in a DynamoDB Streams-triggered AWS Lambda function.Independent keys have different key material, so ciphertext from one Region cannot be decrypted in the other without a custom re-encryption pipeline, which the compliance team wants to avoid.
3. CUse the AWS owned key for DynamoDB encryption at rest and remove client-side encryption.AWS owned keys protect data at rest but give the company no control over the key or its use, and they remove the client-side encryption the application relies on.
4. DCreate a single-Region KMS key in us-east-1 and have the eu-west-1 application call KMS in us-east-1 for every decrypt operation.Cross-Region decrypt calls add latency and fail when KMS in us-east-1 is unavailable, which breaks the local decryption requirement.