An S3 bucket must be accessible ONLY through a specific VPC endpoint — requests from the internet or other networks must be denied even for authenticated IAM users. Which mechanism enforces this?
A.Security group rules on the bucket
Security groups are instance-level — S3 has no SG concept.
B.Bucket policy with aws:SourceVpce condition denying other access
SourceVpce condition = endpoint-bound access. Correct.
C.Block Public Access alone
BPA blocks public/anonymous access — authenticated users from elsewhere still work.
D.KMS encryption on all objects
Encryption protects content, not the access path.
Why this answer
A bucket policy can condition access on aws:SourceVpce (specific endpoint) or aws:SourceVpc — deny all requests not originating through the approved endpoint. Even valid IAM creds get denied from other networks — the 'private path only' pattern. SGs don't attach to S3; BPA doesn't restrict authenticated access.
Correct answer: B · Last reviewed 2026-11-02
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Data Protection & Encryption practice session.
Practice Data Protection & Encryption