SAA-C03 Question 45
Single answerA company is configuring an application that will run in a private subnet of their VPC in AWS. The application needs to access an Amazon S3 bucket in the same region, but the company wants to avoid using the public internet to improve security. What is the most appropriate solution to achieve this?
- A
Create a VPC endpoint for Amazon S3 and update the route table of the private subnet to use the endpoint.
- B
Configure a NAT gateway in the private subnet to allow the application to access Amazon S3.
- C
Use an Elastic IP to assign a public IP address to the application and access Amazon S3 directly.
- D
Enable internet access for the private subnet by associating it with an internet gateway and access Amazon S3.
Show answer and explanation
Correct answer: A
Explanation
To securely access Amazon S3 from a private subnet without using the public internet, a VPC endpoint for S3 is the most appropriate solution. This enables private connectivity between the VPC and S3, ensuring data does not traverse the public internet. Updating the route table ensures that traffic destined for S3 is routed through the endpoint.
- A. Correct.
Correct. A VPC endpoint for Amazon S3 allows private connectivity between the VPC and S3 without using the public internet. Updating the route table ensures traffic is routed through the endpoint.
- B. Incorrect.
Incorrect. A NAT gateway allows outbound internet access from private subnets, but it still uses the public internet for communication with S3, which does not meet the security requirement.
- C. Incorrect.
Incorrect. Assigning a public IP address to the application would expose it to the internet, which violates the security requirement to avoid using the public internet.
- D. Incorrect.
Incorrect. Associating an internet gateway provides internet access, but it does not ensure private communication with Amazon S3 and compromises the stated security requirement.