Question

A company runs EC2 instances in a private subnet that need to read and write objects in an Amazon S3 bucket. Security requirements state that this traffic must not traverse the public internet. Which approach meets this requirement most cost-effectively without adding NAT infrastructure?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and route traffic to it from the private subnet

Answer

Deploy a NAT gateway in a public subnet so the instances can reach S3 over the internet

Answer

Set up an AWS Direct Connect connection between the VPC and S3

Answer

Attach an internet gateway to the private subnet and assign public IP addresses to the instances