An endpoint should only be reachable from your VPC, with least-privilege access. What do you configure?
Why C is the answer
A VPC interface endpoint and a tightly scoped IAM role
Private connectivity plus scoped IAM satisfies both requirements.
In detail
- A VPC interface endpoint keeps access private.
- A scoped role gives least privilege.
- One control covers the network, and the other covers identity.
Use case
An illustrative scenario, not a real incident.
A hospital allows calls only from its VPC, through an interface endpoint, by a role that can invoke one endpoint.
See it in different ways
flowchart TD A["Secure ML workload"] --> B["VPC and private endpoints"] A --> C["Least-privilege IAM roles"] A --> D["KMS encryption at rest"] A --> E["TLS in transit"]
mindmap
root((Security))
Access
IAM execution role
Network
VPC interface endpoint
Data
KMS customer managed keys
Audit
CloudTrailmindmap
root(("Secure endpoint"))
n1["Network"]
n2["VPC interface endpoint"]
n3["Identity"]
n4["Scoped IAM role"]Key point: Combine private networking and narrow IAM.
Why the other options are wrong
- A. An S3 bucket policy that denies public access
- A bucket policy protects S3, not the endpoint.
- B. A public endpoint with a shared API key in Secrets Manager
- A public endpoint is reachable from outside.
- D. A wider security group rule limited to your office range
- A wider rule grants more access.