A company is designing a serverless application to process a large number of events within an AWS account. The application saves the events to a data…

The core requirement is to ensure traffic between an application in a VPC and an Amazon SQS queue does not traverse the public internet. The solution is to use an interface VPC endpoint for Amazon SQS. This creates an Elastic Network Interface (ENI) within your VPC, allowing resources to communicate with the SQS API endpoint using private IP addresses. All traffic remains securely on the AWS global network. To enforce this private-only access, an SQS queue policy can be configured to deny any requests that do not originate from the specified VPC endpoint, effectively blocking all public access.

B. Configure server-side encryption with SQS-managed keys (SSE-SQS).

This encrypts data at rest within the queue. It does not address the requirement for private network connectivity (data in transit).

C. Configure AWS Security Token Service (AWS STS) to generate temporary credentials for resources that access the queue.

This is an identity and access management best practice for authentication and authorization, but it does not control the network path of the traffic.

D. Configure VPC Flow Logs to detect SQS traffic that leaves the VPC.

This is a detective control for monitoring IP traffic. It can report on traffic leaving the VPC but does not prevent it from using public IP addresses.

1. AWS Documentation

Amazon SQS Developer Guide: "Amazon SQS and interface VPC endpoints" - This document explicitly states

"You can connect directly to Amazon SQS API endpoints from within your virtual private cloud (VPC) by using an interface VPC endpoint... When you use an interface VPC endpoint

communication between your VPC and Amazon SQS is conducted entirely within the AWS network."

2. AWS Documentation

Amazon SQS Developer Guide: "Controlling access to Amazon SQS from virtual private clouds" - This guide provides an example policy demonstrating how to restrict access to an SQS queue to only a specific VPC endpoint. The example policy includes a Condition block with the aws:sourceVpce key to enforce this rule.

3. AWS Documentation

Amazon SQS Developer Guide: "Protecting data using server-side encryption (SSE) and AWS KMS" - This page details that SSE-SQS and SSE-KMS are for encrypting the body of a message within an SQS queue

which is encryption at rest

not in transit over a private network.

4. AWS Documentation

Amazon VPC User Guide: "Logging IP traffic using VPC Flow Logs" - This document describes VPC Flow Logs as a feature to "capture information about the IP traffic going to and from network interfaces in your VPC

" confirming its role as a monitoring tool

not a preventative network control.