Question

A financial services company runs an application on EC2 instances in a private subnet with no internet access and no NAT gateway. The application must call the Amazon DynamoDB and Amazon Kinesis APIs, and the security team mandates that all traffic to these services stay entirely within the AWS network and never traverse the public internet. What is the MOST appropriate way to enable this connectivity?

Accepted Answer

Create a gateway VPC endpoint for DynamoDB and an interface VPC endpoint (AWS PrivateLink) for Kinesis, then update route tables and security groups accordingly.

Answer

Deploy a NAT gateway in a public subnet and add a default route from the private subnet so the instances can reach the service public endpoints.

Answer

Create interface VPC endpoints for both DynamoDB and Kinesis and disable private DNS to force traffic through the endpoints.

Answer

Attach an internet gateway to the VPC and restrict outbound access using a network ACL that only allows the DynamoDB and Kinesis CIDR ranges.