Question

A company runs a data-processing workload on EC2 instances in private subnets across three AZs in one VPC. The instances read and write large volumes of data to Amazon S3 and query an Amazon DynamoDB table, both in the same Region. Currently all this traffic flows through NAT gateways, and the company wants to eliminate the NAT data-processing charges for S3 and DynamoDB traffic while keeping the instances fully private. What is the MOST cost-effective design that meets these requirements?

Accepted Answer

Create gateway VPC endpoints for both S3 and DynamoDB and associate them with the private subnet route tables.

Answer

Create interface VPC endpoints (AWS PrivateLink) for both S3 and DynamoDB in each AZ and update the DNS to resolve to the endpoint ENIs.

Answer

Create a gateway endpoint for S3 and an interface endpoint for DynamoDB, keeping the NAT gateways as a fallback path.

Answer

Replace the NAT gateways with a single NAT instance and add static routes to the S3 and DynamoDB public IP ranges.