Question

A CloudOps engineer deploys EC2 instances in a private subnet with no NAT gateway and no internet gateway route. The instances must download objects from an S3 bucket in the same Region. The engineer creates a gateway VPC endpoint for S3, but the instances still cannot reach the bucket and time out. Nothing was changed on the security groups. What is the MOST likely cause of the failure?

Accepted Answer

The route table associated with the private subnet does not have a route to the S3 gateway endpoint prefix list.

Answer

Gateway endpoints for S3 require a NAT gateway to forward traffic to the S3 service.

Answer

The instances need a public IP address to use the S3 gateway endpoint.

Answer

Gateway endpoints only work with S3 buckets in a different AWS Region.