Restrict S3 Bucket to a Specific VPC — Using aws:SourceVpc Condition Key

• A.Create an IAM policy that restricts access to the VPC and attach it to all users.
• B.Attach a security group to the S3 bucket that allows traffic from the VPC.
• ✓ C.Add a bucket policy with a condition that requires aws:SourceVpc to be the VPC ID.
• D.Create a VPC Endpoint policy that allows access only from the VPC.

Why C: Option C is correct because S3 bucket policies can use the aws:SourceVpc condition key to restrict access to requests originating from a specific VPC. Option A is wrong because IAM policies are attached to users, roles, or groups, not to the bucket itself, and they cannot restrict based on VPC directly. Option B is wrong because security groups cannot be attached to S3 buckets; they are used for EC2 instances and other resources. Option D is wrong because a VPC Endpoint policy controls what actions are allowed through the endpoint, but it does not restrict access based on the source VPC; the bucket policy is required for that.

• A.Configure a VPC endpoint policy
• B.Configure a network ACL to block all traffic except from the VPC CIDR
• C.Use an S3 access point with a network origin condition
• ✓ D.Attach an S3 bucket policy with a condition for aws:SourceVpc

Why D: S3 bucket policies support condition keys like `aws:SourceVpc` to restrict access to traffic originating from a specific VPC. Option D is correct because attaching a bucket policy with this condition directly limits access to the desired VPC. Option A is incorrect because a VPC endpoint policy controls actions allowed via the endpoint, but does not replace the need for a bucket policy. Option B is incorrect because network ACLs operate at the subnet level and cannot enforce S3 access restrictions. Option C is incorrect because while S3 access points can have policies, they are not the primary method for restricting access by VPC; a bucket policy with the `aws:SourceVpc` condition is the appropriate approach.