AWS Certified Solutions Architect - Professional (#102)

A company is migrating its on-premises build artifact server to an AWS solution. The current system consists of an Apache HTTP server that serves artifacts to clients on the local network, restricted by the perimeter firewall. The artifact consumers are largely build automation scripts that download artifacts via anonymous HTTP, which the company will be unable to modify within its migration timetable. The company decides to move the solution to Amazon S3 static website hosting. The artifact consumers will be migrated to Amazon EC2 instances located within both public and private subnets in a virtual private cloud (VPC). Which solution will permit the artifact consumers to download artifacts without modifying the existing automation scripts?

Create a NAT gateway within a public subnet of the VPC. Add a default route pointing to the NAT gateway into the route table associated with the subnets containing consumers. Configure the bucket policy to allow the
s3:ListBucket
and
s3:GetObject
actions using the condition
IpAddress
and the condition key
aws:SourceIp
matching the elastic IP address of the NAT gateway.
Create a VPC endpoint and add it to the route table associated with subnets containing consumers. Configure the bucket policy to allow
s3:ListBucket
and
s3:GetObject
actions using the condition
StringEquals
and the condition key
aws:sourceVpce
matching the identification of the VPC endpoint.
Create an IAM role and instance profile for Amazon EC2 and attach it to the instances that consume build artifacts. Configure the bucket policy to allow the
s3:ListBucket
and
s3:GetObjects
actions for the principal matching the IAM role created.
Create a VPC endpoint and add it to the route table associated with subnets containing consumers. Configure the bucket policy to allow
s3:ListBucket
and
s3:GetObject
actions using the condition
IpAddress
and the condition key
aws:SourceIp
matching the VPC CIDR block.