Determine security controls for a new solution that enforce least privilege with IAM roles, scoped resource policies, security groups, network ACLs and VPC endpoints.

A fintech firm is designing a new payments service whose EC2 instances run in private subnets and must call AWS Secrets Manager privately, with no route to the public internet. The security team requires that calls to Secrets Manager stay on the AWS network, that only this one application's instances can use the path to the service, and that the path can retrieve only secrets carrying a specific tag rather than every secret in the account. They want to enforce both a network-layer restriction on who may use the endpoint and a service-layer restriction on what may be retrieved through it. Which TWO controls together meet these requirements? (Select TWO.)

• AAttach a security group to the interface VPC endpoint for Secrets Manager that allows inbound HTTPS only from the application instances' security group, so just those instances can send requests through the endpoint over private connectivity.check_circle Correct
• BAttach a VPC endpoint policy to the Secrets Manager interface endpoint that allows GetSecretValue only on secrets matching the required resource tag, so requests through the endpoint can reach only those tagged secrets.check_circle Correct
• CReplace the interface endpoint with a gateway VPC endpoint for Secrets Manager and attach an endpoint policy that allows retrieval only of the tagged secrets, keeping the traffic on the AWS network without any elastic network interface to secure.
• DAdd a network ACL on the private subnets that permits outbound HTTPS only to the Secrets Manager service prefix list and denies all other egress, relying on the stateless subnet rules to identify which application instances may use the endpoint.
• EAttach a resource-based policy to each individual secret that allows access from the application's IAM role, expecting these secret policies alone to keep traffic on the AWS network and to restrict which instances reach the endpoint.

Why A is correct: An interface endpoint is an elastic network interface that carries its own security group, so allowing inbound HTTPS only from the application's security group restricts at the network layer which instances may use the private path to Secrets Manager.

Why B is correct: A VPC endpoint policy scopes what may be called through that specific endpoint, so a tag-conditioned allow on GetSecretValue limits retrieval through the path to only the tagged secrets, enforcing the service-layer least-privilege restriction.

Why C is wrong: Gateway endpoints exist only for Amazon S3 and DynamoDB, so Secrets Manager cannot be reached through a gateway endpoint, making this option technically impossible despite sounding like the low-cost private path.

Why D is wrong: A network ACL is stateless and matches only CIDR ranges, so it cannot identify a particular application's instances by identity and cannot scope which secrets are retrievable, failing both the per-instance and per-secret requirements.

Why E is wrong: Secret resource policies can scope which principals read a secret, but they neither keep traffic on a private network path nor restrict which instances may use the endpoint, so they do not satisfy the network-layer requirement.