Question 188:
You have an EC2 instance that needs to work with a DynamoDB table through a VPC Gateway endpoint for DynamoDB. For the IAM role used by the EC2 instance, there is a requirement to deny the actions to List and Describe DynamoDB tables if the connection does not go through the VPC Gateway endpoint. How would you achieve this requirement?
Answer options:
A.Create a DynamoDB resource policy as below:
{
"Statement": [
{
"Sid": "ReadOnly",
"Action": [
"dynamodb:DescribeTable",
"dynamodb:ListTables"
],
"Effect": "Allow",
"Resource": "vpce-11aa22bb"
}
]
}
B.Create a VPC endpoint policy as below:
{
"Statement": [
{
"Sid": "ReadOnly",
"Principal": "*",
"Action": [
"dynamodb:DescribeTable",
"dynamodb:ListTables"
],
"Effect": "Allow",
"Resource": "*"
}
]
}
C.Create an IAM policy for your IAM entities to restrict the actions as below:
{
"Statement": [
{
"Sid": "ReadOnly",
"Principal": "*",
"Action": [
"dynamodb:DescribeTable",
"dynamodb:ListTables"
],
"Effect": "Deny",
"Resource": "arn:aws:dynamodb:region:account-id:table/*",
"Condition": { "StringNotEquals" : { "aws:sourceVpce":
"vpce-11aa22bb" } }
}
]
}
D.Create a VPC endpoint policy as below:
{
"Statement": [
{
"Sid": "ReadOnly",
"Action": [
"dynamodb:DescribeTable",
"dynamodb:ListTables"
],
"Effect": "Allow",
"Resource": "vpce-11aa22bb"
}
]
}