Regional partner agencies must upload telemetry into the city’s analytics platform, but security policy forbids exposing raw Amazon S3 buckets publicly on the internet. Which approach best provides private, authenticated ingest access points?
Select an answer to reveal the explanation.
Short Explanation
Partners shouldn’t get a master key to the raw S3 closet. Private API Gateway or VPC interface endpoints give authenticated front doors while the buckets stay off the public internet. Open buckets, wiki secrets, and emailed CSVs with plaintext keys are how incidents start.
Full Explanation
Secure ingestion patterns use private authenticated fronts—such as private API Gateway APIs or VPC interface endpoints (PrivateLink)—so partners do not write directly to publicly reachable raw buckets. Disabling encryption and opening buckets, relying on obscurity, or moving files through email with embedded long-lived keys violate least privilege and municipal security expectations. Architecture should keep durable storage private and expose only controlled ingest interfaces.