Question

A financial services company runs an application on EC2 instances in a private subnet with no route to an internet gateway or NAT gateway. The application must read and write objects in an Amazon S3 bucket in the same Region. Security policy prohibits any traffic to S3 from traversing the public internet. Which solution meets these requirements with the least operational overhead?

Accepted Answer

Create a gateway VPC endpoint for Amazon S3 and update the private subnet's route table to direct S3 traffic to the endpoint.

Answer

Deploy a NAT gateway in a public subnet and add a default route so the private instances can reach S3 over HTTPS.

Answer

Configure an AWS Direct Connect connection between the data center and the VPC to route S3 traffic privately.

Answer

Create an interface VPC endpoint for Amazon S3 in each Availability Zone and attach an internet gateway to the VPC.