Question

A company has a Direct Connect connection between their on-premises data center and AWS. Applications on-premises need to access Amazon S3 buckets over the Direct Connect link without traversing the public internet, while also being able to reach EC2 instances in a private subnet of their VPC. Currently only a private VIF is configured, allowing access to the VPC. Which action should the CloudOps engineer take to enable on-premises access to S3 over Direct Connect while keeping traffic off the public internet?

Accepted Answer

Create a public virtual interface (public VIF) on the Direct Connect connection to reach S3 public endpoints over the private DX link.

Answer

Add a gateway VPC endpoint for S3 and route on-premises traffic to it through the existing private VIF.

Answer

Configure a NAT gateway in the VPC and route the on-premises S3 requests through the private VIF and NAT gateway.

Answer

Enable an internet gateway in the VPC and update the private VIF route table to send S3 traffic to it.